Penetration Testing
// Pentest
We break in. With your permission.
A pentest shows how far an attacker can get into your systems. Our tester identifies vulnerabilities and attempts to actually gain access.
That is the difference with an audit: an auditor also looks for vulnerabilities but does not break in.
- Real intrusion attempts, not a checklist
- Risk per finding: probability × impact
- Report with concrete advice
// Three types of tests
How much does the tester know in advance?
The more the tester knows, the more deeply they can test. The less they know, the more it resembles a real attack.
Black box
Only your name and perhaps an IP address or URL. The tester discovers the rest themselves.
Suitable for
Seeing what an outsider can achieve
Grey box
A clear scope of what is being tested. The test remains within boundaries and proceeds faster.
Suitable for
Web applications. The most commonly used test
White box
Everything: scope, application details, test accounts, and sometimes the source code.
Suitable for
Thorough testing during software development
// How it works
From agreement to report
Agreement
Which systems, how much information, and when.
Permission
You provide written consent and indemnify ID Control.
Testing
Usually a few days, depending on the number of systems.
Report
Findings and advice per application or server.
// The report
What you receive from us
A report you can act on immediately.
Executive summary
The most important risks in brief.
Methods used
What we tested and how.
Strategic and tactical advice
What you need to arrange as an organization.
Operational advice
Per application or server: what needs to be done.
How secure are you really?
Have it tested before an attacker does
Tell us what you want to have tested. We will create a tailored proposal.