All services Penetration Testing
See how an attacker would get in, before one does.
We attack your systems the way a real attacker would, within the scope you choose. You get proof of what works, what it exposes, and the fix for each finding.
Any logged-in customer could read any other customer’s invoices by changing one number in the request.
Request · test account “client-b”
GET /api/v2/invoices/10482 HTTP/1.1 1
Host: portal.example-company.ca
Cookie: session=7f3c…e91aServer response
HTTP/1.1 200 OK 2
{ "invoice": 10482,
"customer": "Client A Inc.", 3
"total": 18450.00, … }- 1Only the invoice number was changed. That invoice belongs to Client A.
- 2The server should have refused the request (403 Forbidden).
- 3Client A’s name, address and amounts came back.
Fix: on every request, check server-side that the invoice belongs to the logged-in account. Retest: fixed
What we test
- External networkFirewalls, VPNs, web servers and cloud services anyone can reach.
- Internal networkWhat an insider or one infected laptop could reach from inside.
- Web applicationsPortals and apps: logins, access control, business logic.
- Mobile applicationsiOS and Android apps and the APIs behind them.
- WirelessGuest and staff Wi-Fi, rogue access points, weak encryption.
- Social engineeringPhishing and pretext calls that test your people.
- Hardware and IoTDevices, cameras, controllers and embedded systems on your network.
How small weaknesses chain into a breach
Scanners list problems one at a time. We show how they connect into a real breach.
- 01 Phishing emailA finance clerk enters her password on a fake login page.
- 02 Staff laptopThe same password opens the VPN. No MFA.
- 03 Reused passwordA local admin password is identical on every PC.
- 04 File serverAdmin rights reach the shared drives.
- 05 Client records4,200 client files readable and copyable.
A real pentest finds what scanners can’t
Automated scans are useful, but they only check for known patterns. They can’t chain weaknesses or understand how your business works, and that is where real attacks happen.
Two different goals
| Vulnerability assessment | Penetration test | |
|---|---|---|
| The question it answers | What known weaknesses do we have, and which do we fix first? | Could an attacker actually get in, and how far would they go? |
| Goal | Breadth: find as many known issues as possible | Depth: prove real impact on what matters most |
| How | Automated scanning, reviewed by a person | Skilled people attacking like a real adversary |
| How often | Monthly or quarterly | Yearly, or after major changes |
| What you get | A ranked list of known weaknesses | Proof, attack paths and business impact |
- TLS 1.0 enabled on mail.example-company.ca
- Missing security header (X-Frame-Options)
- Server version disclosed in banner
- Cookie without SameSite attribute
- … 214 more low and informational items
- Read every customer’s invoices by changing one number in the portalScanner: not detected
- Smart thermostat on guest Wi-Fi became a way into the accounting networkScanner: not detected
- Reset any user’s password through a flaw in the help-desk portalScanner: not detected
- Domain admin in under 3 hours by chaining three “low” findingsScanner: rated each one low
- Business logicA scanner sees a valid request. A person sees that it returns someone else’s data.
- ChainingThree “low” issues can add up to full access. Only a person connects them.
- Confirmed by handEach finding is checked and proven, so your team doesn’t chase noise.
- ProofYou see exactly what an attacker could do, which makes fixing it easy to justify.
What you get
- Executive summaryOne page for leadership: the risk in business terms and what to fix first.
- Technical findingsEach finding rated by risk, with steps to reproduce, proof and the fix.
- RetestOnce you’ve fixed things, we check again and confirm the holes are closed.
How it works
- Scoping callWe agree on what is in scope, what is out, and what a good result looks like for you.
- The workThe expert who scoped it leads it, and keeps you posted on anything urgent.
- ReportFindings ranked by risk, with the fix for each, walked through with your team.
- Follow-upWe answer questions and check your fixes where it is part of the engagement.
When to get one
- An audit asks for itPCI DSS, SOC 2 and ISO 27001 expect a real test with a real report.
- Your insurer asks for itIt can mean better terms, or simply keeping your coverage.
- You’re launching somethingA new app, portal or API. Fixing before launch costs far less.
- Your IT changedA merger, cloud move or new office shifts what attackers can reach.
- You hold sensitive dataPayment, health or personal information raises the stakes.
- You’ve never had oneThen you don’t know what an attacker would find. A first test sets your baseline.
Examples on this page are illustrative, based on common real-world findings.
Request a Penetration Test
Tell us what's going on. The expert who would lead the work replies within 1–2 business days, in English or French.