Infrastructure · network · servers

Penetration testing for your network and infrastructure

We see your company the way an attacker on the internet, or one already inside the network, sees it — and show you how far they can get.

External and internalBlack-box or grayboxWi-Fi and VPN on request
Request a quote →How we work
What we test

From the perimeter to the domain controller

The external test shows what is visible from the internet; the internal one, what someone who got past it can do.

The exposed perimeter

Ports, services and protocols open to the internet, vulnerable versions, administration panels and remote access left in plain view.

The internal network

What a compromised computer or a visitor plugged into a socket can do: segmentation, VLANs, unprotected internal services, lateral movement.

Active Directory

Weak or reused passwords, service accounts with excessive rights, delegations and escalation paths up to domain administrator.

Servers and workstations

Missing updates, default configurations, open shares, unnecessary services and sensitive data left on reachable disks.

Wi-Fi

WPA2/WPA3 strength, rogue access points and isolation of the guest network from the internal one.

VPN and remote access

The VPN configuration, authentication (including 2FA) and which resources a remote account opens once connected.

Request a quote

Build your request in two minutes

Three steps, no prices to guess: tell us what you have, and within one business day you receive the scope, duration and schedule of the test.

  1. 1 What we test
  2. 2 How and when
  3. 3 Where we reply
What should we test?
How many external IP addresses?
How many workstations and servers internally?
In how many locations (offices, branches)?
How do we test?
When may we test?
Does a regulation or audit apply to you?
When do you need the report?
One per line. Nothing is tested before a signed authorisation.

We use your details only to answer this request. Privacy policy

Methodology

How the project unfolds

Following PTES, OSSTMM and NIST SP 800-115 — and after a signed testing authorization, before any test.

  1. Scope and quote

    You tell us what is in scope; you receive a quote with the scope, duration and schedule within one business day.

  2. Testing authorization

    You sign the authorization in the portal: the targets, the testing window and the rules. No test starts without it.

  3. Reconnaissance and testing

    We map the network: addresses, services and how they connect, then test manually, with automated tools only as support. You follow the testing status in the portal.

  4. Report and walkthrough

    You receive the executive and technical reports; serious findings are flagged to you immediately, not at the end.

  5. Remediation and retest

    Once you fix them, you request the retest from the portal: we verify each finding and close it with evidence.

What you receive

Deliverables

  • Executive report: the risk in terms management understands, without jargon
  • Technical report: every finding with severity, evidence and reproduction steps
  • Concrete remediation steps, for your technology
  • Findings in the portal: owner, due date, history and one-click retest
  • An attestation letter for auditors, publicly verifiable
Further reading

Guides related to this service

How to prepare for a pentestMoldova cybersecurity law guideISO 27001 and SOC 2 guidePentest or vulnerability scan?NIS2 and GDPR guide
FAQ

What clients ask us

How long does an infrastructure pentest take?
Usually 5–10 days of testing, depending on the number of addresses and segments; complex projects take 7–14 days. We fix the exact duration in the quote once we see the scope.
What is the difference between black-box and graybox?
In black-box we start as an outside attacker, with no information. In graybox we receive a regular account or network access, like an employee or a compromised laptop — so we see what can be done after the first breach, not only whether one can get in.
Is there any risk to our systems?
We work with maximum caution: tests are scheduled with you, after a signed testing authorization, and any action that could affect operations is agreed in advance or performed on a test environment.
What do we receive at the end?
An executive report for management and a technical one for the team: every finding with its severity (critical, high, medium, low), the evidence and the remediation steps. You also track the findings in the portal, where you request the retest once they are fixed.

Want to know how far an attacker gets in your network?

Describe the scope; we reply with a quote within one business day.

Request a quote →