Français
NederlandsPenetration testing
Find out what an attacker would find, before they do. We test your applications, networks and users within an authorised scope, then hand you fixes ranked by priority.
When to run a penetration test
- Before putting an application or API into production.
- After a major change to your infrastructure or a migration.
- To demonstrate the effectiveness of your security measures under NIS2, CyFun or ISO 27001.
- When a customer, insurer or auditor asks for it.
- After an incident, to check that no door has been left open.
What we test
Web applications and APIs
Authentication, session management, access control, injections and business logic.
External infrastructure
What is exposed on the internet: services, remote access, email and configurations.
Internal infrastructure
What an attacker could reach from a compromised workstation: directory (Active Directory), shares, privileged accounts.
Vulnerability assessment
Inventory of the known weaknesses in your systems and prioritisation of fixes according to the real risk.
Simulated phishing
Test and awareness campaigns to measure and improve your staff's reflexes.
AI-augmented testing
Artificial intelligence tools specialised in offensive security widen coverage and speed up analysis. Every finding is verified by an expert, within the authorised scope and under the confidentiality of the assignment.
How it works
Every test combines a specialist's manual analysis (business logic, chaining of vulnerabilities, bypassing controls) with recognised tools. We follow public frameworks: the OWASP Web Security Testing Guide for applications and APIs, PTES and NIST SP 800-115 for infrastructure.
Scoping
Objectives, scope, dates and emergency contacts are set in writing. No test starts without your signed authorisation.
Testing
Manual analysis and tools for mapping, vulnerability discovery and exploitation, within the agreed windows and with care for sensitive systems.
Report
Each vulnerability is demonstrated, rated by severity and comes with a remediation recommendation. An executive summary is written for management.
Debrief
Presentation of the results to your teams and prioritisation of fixes. On request, a retest checks that they are effective.
Frequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A scan automatically lists known weaknesses. A penetration test goes further: a specialist checks whether they can be exploited, chains them together and measures how far an attacker could get.
Can the test disrupt our systems?
The risk is managed: scope and time windows agreed in advance, methods adapted to sensitive systems and direct contact with your teams during testing. The most intrusive actions are only carried out with your explicit consent.
Is a penetration test mandatory under NIS2?
The NIS2 Directive does not require one as such, but its Article 21 calls for policies and procedures to assess the effectiveness of security measures. A penetration test is one of the most concrete ways to demonstrate it.
How long does a test take?
It depends on the scope: a few days for a targeted application, longer for a large infrastructure. The quote sets out the duration, the method and the deliverable.
Do you use artificial intelligence during testing?
Yes, as a support tool: models specialised in offensive security widen coverage and speed up analysis, but every finding is verified by an expert before it appears in the report. Data from your assignment is not reused to train these models, and their use stays within the scope you have authorised.