PENETRATION TESTING
Penetration Testing Services
Manual, human-led security testing for web applications, APIs, cloud infrastructure and smart contracts, delivered by certified pentesters and reported so your auditor can use it.
Every engagement includes
- Manual testing by certified pentesters
- Executive summary and technical report
- Step-by-step remediation guidance
- Re-test available after fixes
- Findings mapped to NIS2, DORA, GDPR, PCI DSS
Scope, tester-days and price agreed before testing starts.
OSCP, OSCE and CISSP certified testers. 10+ years of offensive security operations. EU-based company.
Certifications held by our testers
What is penetration testing?
Penetration testing is a controlled, authorized simulation of a real attack, performed by security professionals who try to break into your systems the way a criminal would and then document exactly how they did it. A vulnerability scan matches software versions and configurations against a database of known issues. A penetration test goes further: it chains weaknesses together, tests business logic, and proves impact. The tester doesn’t stop at “this endpoint might be vulnerable”; they show you the extracted record or the admin session they obtained. A scanner can’t notice that an invoice ID is guessable and belongs to another customer. A human tester can. Scanning is cheap and should run continuously; penetration testing is deeper, periodic, and human-driven. Most compliance frameworks ask for both. Still deciding which one you need? Read our guide to penetration testing vs vulnerability scanning.
Manual, not a scan
Automated tools report what might be wrong. A penetration test proves what an attacker can actually do with it: the account taken over, the data reached, the transaction manipulated. Every finding in our reports comes with reproduction steps and evidence.
Our penetration testing services
Twelve services, one delivery standard: manual testing, evidence for every finding, and a re-test available after you fix.
Web Application Penetration Testing
Manual testing of the application layer: authentication, session handling, authorisation between roles, file uploads and the business logic no scanner understands. Aligned with the OWASP Web Security Testing Guide.
API Penetration Testing
REST, GraphQL and webhook endpoints tested against the OWASP API Security Top 10: object level authorisation, token handling, rate limiting and business flow abuse, checked role by role.
External Penetration Testing
Everything you expose to the internet, tested from the position of an attacker with no access and no credentials: the real asset inventory, exposed portals and authentication, edge services and misconfiguration.
Internal Penetration Testing
Assumed breach from a standard user account: Active Directory attack paths, lateral movement, privilege escalation to domain admin and whether your network segmentation actually holds.
Network & Infrastructure Penetration Testing
One engagement across your whole network: the internet-facing perimeter, the internal network, Wi-Fi, VPN and remote access, network devices and cloud network controls, with segmentation and firewall rules tested as the links between them.
NIS2 Penetration Testing
Security testing that shows whether your NIS2 risk-management measures work, documented as evidence for Article 21(2) and for audits by your competent authority: scope, methodology, findings with criticality, remediation and retest.
Cloud Penetration Testing (AWS/Azure)
AWS accounts and Azure subscriptions tested by hand: IAM and Entra ID permissions, storage exposure, security groups, serverless functions, Kubernetes and pipeline secrets, chained into proven attack paths. Network-level testing is covered by network penetration testing. Infrastructure and cloud testing runs $5,000 to $12,000+ depending on scope (see pricing).
Regulatory Compliance Pentesting (NIS2, DORA, GDPR, HIPAA, PCI DSS)
This is a penetration test scoped and documented to support a specific regulation or audit. We start from the control language (PCI DSS requirement 11.4 or GDPR article 32, for example) and build the scope, evidence, and report structure around what your auditor will ask for. The hands-on testing is the same manual work as our other services; what changes is the traceability. Typical outputs: findings mapped to the relevant controls, an Executive Summary written with the auditor in mind, and a re-test available to confirm fixes. Best fit: regulated entities preparing for an audit, supervisory review, or customer security questionnaire. Pricing follows the underlying test type (see pricing).
See NIS2 penetration testing and DORA threat-led penetration testing.
TLPT (Threat-Led Penetration Testing)
Threat-led penetration testing is intelligence-led red team testing of critical or important functions on live production systems, for financial entities selected by their TLPT authority under DORA. The test follows the phases of the RTS on TLPT, is aligned with TIBER-EU, and the scenarios come from your threat intelligence provider. A full TLPT includes at least 12 weeks of active red team testing and is quoted individually.
Red Teaming Operations
Red Teaming answers a single question: can an attacker reach your crown jewels without being caught? Instead of listing every vulnerability, we pursue agreed objectives (domain admin, the customer database, the payment system) through external exploitation, cloud entry points, lateral movement and privilege escalation, with every technique mapped to MITRE ATT&CK. Your defenders are usually not told in advance, so the exercise also measures detection and response. You get the full attack path, where alerts fired or stayed silent, and what to fix first. Best fit: organizations with a mature security program and an in-house SOC or MDR provider. Red team operations start at $15,000 (see pricing).
Smart Contract Penetration Testing
We review smart contract code together with the off-chain components attackers actually go after: oracles, bridges, front-ends, and admin key management. The assessment combines line-by-line manual code review with dynamic testing on a forked chain, covering reentrancy, access control, arithmetic and precision errors, upgradeability risks, and front-running exposure. Typical findings: missing access checks on privileged functions, unsafe external calls, price manipulation through oracle dependencies. Best fit: DeFi protocols, token launches, NFT platforms, and companies adding Web3 payments, ideally before mainnet. Scope is priced per contract complexity in tester-days; request a tailored quote.
Mobile Application Penetration Testing
Manual iOS and Android testing of on-device data, network traffic and the backend API, aligned with OWASP MASVS and MASTG. From $3,500 for a mobile app (iOS or Android); see pricing.
Which penetration test do you need?
Match your situation to a row below. If none fits, describe it on the contact page and we’ll scope it with you.
| Your situation | Recommended test | Typical scope | Learn more |
|---|---|---|---|
| Launching a SaaS product | Web App & API pentest (grey box) | All user roles, multi-tenant isolation, public API, auth flows | Fintech API case study |
| Preparing for a PCI DSS audit | Compliance pentest (external, internal, application) | Cardholder data environment, segmentation controls, payment pages | Pricing |
| Financial entity selected for TLPT under DORA | TLPT | Critical or important functions in production, intelligence-led scenarios | Threat-led testing |
| E-commerce before Black Friday | Black-box web pentest plus infrastructure | Storefront, checkout, payment integrations, CDN and WAF configuration | Retail case study |
| Medtech or health SaaS handling PHI | Compliance pentest (GDPR and HIPAA) with web app testing | Patient data flows, access control, encryption, audit logging | Medical SaaS case study |
| Web3 protocol before mainnet | Smart contract pentest | Contracts, upgrade mechanisms, oracles, admin keys | Request a quote |
How we run a penetration test
Every engagement follows the same five stages, aligned with PTES and NIST SP 800-115.
1. Scoping and rules of engagement
We agree on targets, exclusions, test windows, emergency contacts, and the model: black box (no prior knowledge), grey box (user accounts and documentation), or white box (source code and architecture). You sign an authorization letter before anything is touched.
2. Reconnaissance
We map the attack surface: subdomains, exposed services, third-party components, leaked credentials, and employee footprint. This mirrors what a real attacker sees first.
3. Vulnerability analysis
Automated tooling finds the obvious. The tester then verifies each lead by hand, discards false positives, and hunts for logic flaws and chained weaknesses.
4. Exploitation and post-exploitation
We exploit confirmed vulnerabilities to demonstrate real impact, then assess how far an attacker could go: privilege escalation, lateral movement, data access. Evidence is captured at each step.
5. Reporting and re-test
You receive the two-part report within days of testing. After you fix the issues, a re-test is available to confirm they’re closed.
What you receive
Executive Summary
overall risk rating, business impact, and top actions, written for management.
Technical Report
every vulnerability with severity, affected assets, reproduction steps, and screenshot or request/response evidence of exploitation.
Remediation steps
for each finding, so developers and admins can fix without guessing.
Re-test after fixes
A retest is available after fixes, with an updated report confirming which issues are closed.
One report in two parts, written for two audiences, with a re-test available after fixes.
A typical pentest runs one to three weeks, plus a few days for the report.
Penetration testing for EU and international compliance
Most regulations don’t say “hire a pentester,” but they require proof that security controls work.
DORA
Regulation (EU) 2022/2554: articles 26 and 27 require financial entities identified by their TLPT authority to run threat-led penetration testing, generally at least every three years. See our threat-led penetration testing page.
NIS2
Directive (EU) 2022/2555: article 21 obliges essential and important entities to adopt risk-management measures and assess their effectiveness. A recurring pentest is the standard evidence.
GDPR
Regulation (EU) 2016/679: article 32 requires “a process for regularly testing, assessing and evaluating the effectiveness” of technical measures. A pentest of systems processing personal data gives direct evidence for it.
PCI DSS v4.0
PCI Security Standards Council: requirement 11.4 mandates penetration testing at least every 12 months and after significant changes.
HIPAA
The Security Rule doesn’t name penetration testing, but auditors expect evidence that safeguards protecting PHI have been evaluated.
SOC 2 and ISO 27001
Both expect a working vulnerability management process, and auditors routinely ask for the latest pentest report as proof.
Why Pentestica
Certified testers
OSCP, OSCE, and CISSP holders do the hands-on work.
10+ years of offensive security operations
behind every engagement.
Manual-first
Automated tools support the tester; they never replace them. Every finding is verified and exploited by hand.
An EU-based company
A registered EU company, testing under EU law and GDPR, with a written authorisation and rules of engagement before any test starts. Tester-day pricing, no hidden fees.
Case studies
Real engagements, with the findings that mattered.
API Penetration Testing for a FinTech Platform
A grey box test of a payment API uncovered a critical IDOR and a race condition that allowed double spending, both missed by automated scans.
GDPR & HIPAA Pentest for a Medical SaaS
A white box review before an investment round: encryption gaps and broken role-based access control, fixed and verified in a re-test.
Black Box Pentest Before Black Friday
SQL injection, cloud misconfiguration and a coupon logic flaw found and patched before peak season; the platform held with zero incidents.
Frequently asked questions
How much should a penetration test cost?
A standard web application or API test costs $2,500–$5,500, a mobile app test (iOS or Android) starts from $3,500, complex infrastructure or cloud (AWS and Azure) costs $5,000–$12,000+, and red teaming starts from $15,000; a full DORA TLPT is quoted individually. Every quote is a fixed number of tester-days with no hidden fees. See penetration testing cost by test type. For market context, compare these prices with the average cost of penetration testing by test type. Regional pricing differs; see our UAE pentesting guide.
Is penetration testing illegal?
No, as long as it’s authorized. Testing systems you own or have written permission to test is legal; testing without authorization is a crime in the EU, US, and UK. That’s why every engagement starts with a signed scope and authorization letter.
What are the 5 stages of penetration testing?
Scoping and rules of engagement, reconnaissance, vulnerability analysis, exploitation and post-exploitation, and reporting with re-test. Names vary between PTES and NIST SP 800-115; the sequence doesn’t.
Is AI replacing pentesters?
Not for the parts that matter. AI speeds up reconnaissance and triage, and we use it. Business logic abuse, chained exploits, and judgment about real impact still need a human tester. AI makes pentesters faster, not redundant.
How long does a penetration test take?
One to three weeks for most tests, plus a few days for the report. A single web app can take about a week; a multi-account cloud estate takes longer. Red team and TLPT engagements are scoped individually.
Ready to test your defenses?
Tell us what you need tested, the rough scope and your deadline. You get a fixed scope, a fixed number of tester-days and a fixed price before anything starts.