Vorpsel / Services / Offensive security
Penetration testing
We test how an attacker could compromise your applications and infrastructure. Manual testing validates weaknesses, shows their impact and gives your team a clear path to fix them.
At a glance
- For Product, technology and security teams
- Format Defined scope, with one-off or recurring assessments
- Approach Manual testing supported by automated tools
- You receive Validated findings and a prioritized remediation plan
Understand what a weakness means for your business
A scanner can flag a potential vulnerability. A penetration test checks whether it can be exploited within the agreed scope, what access it allows and which data or operations it puts at risk.
We combine automated discovery with manual investigation of authentication, authorization and business logic. Each confirmed finding includes evidence, context and guidance your team can use to remediate it.
When this makes sense
Before a launch
Validate a new application, API or mobile release before exposing it to customers.
After important changes
Check new integrations, permissions and critical workflows after a significant change.
Customer requirements
Give customers a technical assessment when they review your security before signing a contract.
Audit preparation
Gather evidence of testing for the systems and requirements agreed in scope.
Infrastructure changes
Assess exposure after migrations, network changes or the adoption of cloud services.
Periodic validation
Reassess critical assets as your environment and its attack surface evolve.
What the engagement covers
Web applications and APIs
We test the running application and its interfaces, focusing on the actions and data an attacker could reach.
- Authentication, sessions and account recovery
- Authorization and separation between customers
- Input handling, uploads and business logic
Internal and external networks
We assess exposed services and internal paths that could allow unauthorized access or broader compromise.
- Internet-facing services and exposed administration interfaces
- Network segmentation and access restrictions
- Privilege escalation and lateral movement within scope
Cloud environments
We investigate how identities, permissions and exposed resources could be combined into an attack path in the agreed cloud accounts.
- Identity permissions and privilege boundaries
- Storage exposure and access to sensitive resources
- Secrets and trust relationships between services
Mobile applications
We assess the mobile client and its communication with back-end services, using the platforms and builds defined in scope.
- Local storage of sensitive data and credentials
- Session handling, transport protection and API interactions
How it works
Scope, access, testing windows and delivery dates are agreed before testing starts. The schedule depends on the assets and depth of the assessment.
Scope and authorization
We agree on assets, test accounts, exclusions and stop conditions, with written authorization and a technical contact.
Discovery and testing
We map the agreed attack surface and manually validate findings. Critical issues are communicated promptly through the agreed channel.
Report and walkthrough
We explain the evidence, business impact and recommended fixes to your technical team and stakeholders.
Remediation and retest
Your team implements the fixes. We validate the agreed findings during the retest window defined in the proposal and update their status.
What you receive
Executive summary
A clear account of the scope, limitations, main risks and recommended priorities for leadership.
Technical report
Validated findings with affected assets, evidence, reproduction steps and remediation guidance.
Prioritized remediation plan
Recommendations ordered by impact and context, with retest status for the findings reviewed in the agreed window.
Ways to work with us
We define the coverage, depth and retest conditions in the proposal, based on your environment and goals.
| Option | Best for | What it includes |
|---|---|---|
| Focused assessment | A specific application, API or critical workflow | Testing of the selected assets, report and agreed retest |
| Broader assessment | Several systems or an infrastructure boundary | Coordinated testing across the agreed scope, consolidated report and agreed retest |
| Recurring assessments | Teams with frequent releases or periodic validation needs | Scheduled assessments with scope reviewed for each cycle and tracking of previous findings |
Questions
How is a pentest different from a vulnerability scan?
A scan identifies potential weaknesses automatically. A pentest adds manual investigation to validate exploitability, test business logic and explain the impact of confirmed findings.
Can you test production systems?
The environment and permitted techniques are agreed during scoping. Production testing requires specific authorization, testing windows, operational limits and a contact who can pause the work.
Do you need accounts or source code?
We can test with no credentials, with test accounts or with additional technical information, depending on the objective. Source code is not required for every pentest; an in-depth code review can be scoped separately.
Does the assessment guarantee that our systems are secure?
A pentest assesses the agreed scope within a defined period. It cannot guarantee the absence of vulnerabilities or replace ongoing security practices. The report records the coverage and limitations so you can use the findings in context.
Other services
Tell us what you need.
We reply with a few questions about scope, then send a proposal with dates and price.