Penetration Testing
Penetration testing that goes past the scanner.
Automated scanners find what's easy to find. Attackers find what's actually exploitable. We test your applications, APIs, and networks by hand — chaining small weaknesses into real attack paths and showing exactly what an attacker could reach.
What we cover
Every engagement is scoped to your environment — these are the areas we typically work across.
Web applications
Authentication, session handling, access control, business logic, and injection flaws — tested manually against OWASP WSTG and ASVS, not just fuzzed.
APIs
REST and GraphQL endpoints: broken object-level authorization, mass assignment, token handling, and rate limiting, mapped to the OWASP API Security Top 10.
Mobile applications
iOS and Android apps and the backends they talk to — local data storage, transport security, and client-side trust assumptions, aligned with OWASP MASVS.
External perimeter
Internet-facing hosts, exposed services, remote access, and forgotten assets — the view an attacker has before they're inside.
Internal network & Active Directory
Assumed-breach testing from inside your network: lateral movement, privilege escalation, and the shortest path to domain admin.
What you get
- Executive summary written for leadership — business risk, not a wall of CVSS scores
- Technical findings with reproduction steps, evidence, and affected assets
- Severity ranked by real exploitability in your environment
- Concrete remediation guidance for every finding
- Debrief walkthrough with your engineering team
- Retest of critical and high findings, included in every engagement
- Methodology
- OWASP WSTG, ASVS, MASVS, and PTES
- Timeline
- Most penetration tests run 1–3 weeks depending on scope.
- Confidentiality
- NDA signed before scoping. Evidence encrypted and deleted on an agreed schedule.
Penetration Testing FAQ
What's the difference between a vulnerability scan and a penetration test?
A scan automatically lists known issues. A penetration test has an experienced operator attempt to exploit them, chain them together, and find logic flaws no scanner can detect — then prove the actual impact.
Black box, grey box, or white box?
We usually recommend grey box — test accounts and some documentation — because it gets far more coverage out of the same time. Black box makes sense when you specifically want an outsider's view.
Will testing disrupt our systems?
We agree on rules of engagement upfront: what's in scope, which actions are off-limits, testing windows, and an escalation path. Production testing follows tighter rules and a clear rollback plan.
How often should we get tested?
At least once a year, and after significant changes — a new product, a major release, or an infrastructure migration. Many compliance frameworks and customers expect regular testing too.
Talk to us about Penetration Testing.
Tell us what you're trying to protect. We'll tell you honestly whether we're the right fit.
contact@ironclav.com · Response within one business day