Penetration testing
Penetration testing that ends in fixes.
A penetration test should tell you what an attacker can do, how they would do it, and what to fix first. PentAIx tests manually, follows the exploit chain and reports in language your engineers can use.
Remote delivery. Fixed scope. Written rules of engagement.
What a penetration test should answer
Which of our systems can be accessed without authorisation?
How far could an attacker get from a single foothold?
Which issues create real business impact, and which are noise?
What should we fix first, and how do we verify the fix?
Coverage
What I test.
Coverage is agreed before the engagement. Not every category is relevant to every target.
Web applications & APIs
Authentication, session management, access control, business logic, injection, SSRF, file handling, API authorisation and rate-limit gaps.
External infrastructure
Internet-facing services, VPNs, mail, remote access and cloud entry points, focused on what is actually reachable.
Internal networks & Active Directory
Segmentation, credential exposure, lateral movement and domain-takeover paths, using an assumed-breach starting point.
Cloud & SaaS configuration
Identity and IAM paths, storage exposure, metadata services and trust relationships between cloud accounts and SaaS tools.
Method
How the work runs.
The engagement follows the same four phases every time. You always know what is happening and what comes next.
Scope
We agree what is in scope, what is off-limits, how we communicate and what a successful engagement looks like.
Test
Manual, exploit-led testing with controlled risk, clear check-ins and an emergency contact available throughout.
Report
Prioritised findings with evidence, business impact and a specific fix your engineers can act on.
Retest
You fix. I verify. A finding is only closed when the remediation has been confirmed.
Deliverables
What you receive.
The report is the product. It should stand on its own after the engagement ends.
Scope and rules of engagement
Targets, exclusions, timing, communication and stop conditions, written down before testing starts.
Findings with evidence
Severity, affected assets, prerequisites, reproduction steps and the evidence needed to verify the issue.
Remediation guidance
A concrete fix path for your engineers, not a generic hardening checklist or a link to a scanner definition.
Retest and closure
A verification pass confirming the fix works, plus a closure note you can share with customers or auditors.
Rules
Rules and boundaries.
- Written scope, named targets and explicit exclusions before testing starts.
- No denial-of-service testing unless it is separately agreed and controlled.
- No testing of third-party systems without written authorisation.
- No exfiltration of production data beyond what is necessary to prove impact.
- Sensitive evidence is encrypted and stored only for an agreed retention period.
FAQ
Questions before scoping.
How long does a penetration test take?
Most engagements run between two and ten testing days, depending on the number of targets, the access provided and the depth required. The proposal states the testing window and reporting date.
Can you test production?
Usually, yes. Testing runs inside agreed windows with controlled exploitation and a named emergency contact. A staging environment is an option when production risk is unacceptable.
What access do you need?
Ideally test accounts at each role, architecture context and a point of contact who can answer questions. Black-box testing is possible, but it changes what can be covered in the time available.
Will this satisfy a compliance requirement?
It can provide independent evidence for a customer or auditor, but whether it satisfies a specific standard is your auditor’s decision. The report is written to be usable as evidence.
What happens after the report?
You fix, I retest. The retest confirms which findings are closed and produces a short closure note. Findings are not considered closed until the fix is verified.
Ready to scope a penetration test?
Tell me what you are testing, why it matters and when you need the result. I will reply with a suggested scope and the next step.