Penetration Testing

A vulnerability scan is automated and identifies known weaknesses through signatures and pattern matching. A penetration test adds extensive manual investigation. Consultants validate each finding, chain issues together, exploit business logic flaws, and demonstrate real-world business impact. Scanners tell you what might be wrong; a pentest confirms what is exploitable, why it matters, and how far an attacker could go.

It depends on what you are protecting and what you need to learn. Web application testing is for customer-facing portals and authenticated business platforms. Mobile testing is for iOS and Android apps that handle sensitive data or transactions. API testing is for REST, SOAP, and GraphQL services that power applications and integrations. Network and infrastructure testing is for your external perimeter, internal network, and Active Directory environment. Many organisations begin with the assets that face the highest external exposure or fall under specific regulatory mandates, then expand from there. Our scoping call helps you identify the right starting point based on your environment, regulatory context, and risk priorities.

The right cadence depends on the rate of change in your environment, your regulatory obligations, and your risk profile. As a general guideline, annually is the baseline expected by most regulatory frameworks (HKMA C-RAF, PCI DSS, SOC 2). Bi-annual or quarterly testing is appropriate for high-rate-of-change environments, multi-tenant platforms, or organisations with elevated threat profiles. We also recommend retesting after significant architectural changes, post-incident remediation, major releases, and prior to launch of new platforms. Many clients combine an annual deep pentest with continuous vulnerability assessment to maintain coverage between engagements.

All engagements are led by senior offensive security consultants. We do not assign junior operators or outsource execution to third parties. Our consultants hold recognised industry certifications across offensive security and red teaming, including credentials such as OSCE³, OSEP, OSWE, OSCP, HTB CPTS, HTB CAPE, CRTO, CRTE, CRTP, and CRTM. Every assessment is reviewed by a senior lead before delivery, ensuring consistent technical depth and reporting quality regardless of engagement type or consultant assigned.

Duration varies significantly by engagement type and scope. As a general guide: a focused web application engagement typically runs 5 to 10 business days of active testing, a mobile or API engagement runs 5 to 12 days, and a network and infrastructure engagement runs 7 to 12 days for internal or 5 to 8 days for external. All engagements include 3 to 5 additional days for reporting and review. Larger or combined engagements can extend to several weeks. Accurate estimates are provided during the scoping call based on your specific environment and objectives.

Most engagements kick off within 1 to 2 weeks of scoping sign-off, subject to consultant availability and the agreed testing window. Where a regulatory deadline or pre-launch milestone requires a faster start, we will do our best to accommodate and confirm feasibility during the scoping call.

Testing is designed to be non-disruptive. Before execution, we agree on the testing window, excluded actions (e.g. denial-of-service, destructive payloads, exploits known to risk service stability), and real-time escalation protocols. Higher-risk techniques are coordinated in advance, and critical findings are communicated immediately rather than waiting for the final report. Where production stability is particularly sensitive, we can perform reconnaissance and identification in production and exploit confirmed findings against representative non-production targets, or test out-of-hours with an open communication channel throughout. Where you operate a SOC, SIEM, or active monitoring tooling, we share testing source IPs, timing, and signatures in advance so your security team can suppress or contextualise the resulting alerts rather than triaging them as live incidents.

Any sensitive data encountered during testing is handled under strict confidentiality. We do not extract, retain, or reproduce sensitive data beyond what is strictly necessary to evidence a finding, and where possible, data is anonymised in the final report. Recovered credentials are not used outside the agreed engagement scope. Credentials provided by you for authenticated testing are held in access-controlled secrets management throughout the engagement, used only for the agreed scope and duration, and confirmed destroyed in writing after engagement closure. All engagement artefacts are stored in access-controlled environments, transmitted over encrypted channels, and securely destroyed after the agreed retention period.

Unless explicitly agreed during scoping, the following are generally excluded: denial-of-service and volumetric load testing, destructive payloads against production systems and data, social engineering and physical intrusion (these are scoped under our Red Team and Phishing Simulation services), and testing of third-party hosted infrastructure or services outside your direct control. OT/ICS environments (SCADA, PLCs, industrial control systems) and wireless network testing require specialised assessment and are scoped separately. Testing is strictly confined to the agreed scope and target list, and exploratory testing of adjacent systems or out-of-scope assets is never performed without prior written authorization.

Yes. A complimentary retest is included with every engagement. After you have applied remediation, we re-examine each confirmed finding to verify that fixes are effective and that no regressions have been introduced, and issue an updated report reflecting closure status for each item. The retesting window is agreed with you during scoping to align with your remediation plan.

Yes. On request, we issue a formal Letter of Attestation summarising the engagement scope, testing period, methodology followed, and high-level outcome. The attestation is suitable for audit, regulatory submission, and third-party assurance purposes, including PCI DSS, SOC 2, ISO/IEC 27001, and HKMA-related obligations.