Penetration testing
We attack your systems with your permission, the way a real criminal would. You learn exactly how someone could get in, what they could reach and how to stop them.
Why test your defences
Firewalls and antivirus tell you what you have bought. A penetration test tells you whether it actually works. Our testers look for the weaknesses that scanners miss: bad configurations, weak passwords, flawed application logic and staff who can be tricked.
Every finding is proven, not guessed. We show the steps we took, what we could access and how serious it is for your business.
Who needs it
- Banks, fintechs and payment providers meeting CBN and PCI DSS requirements
- Companies launching a new website, app or API
- Organisations after a major system change or cloud migration
- Any business that handles customer data and must show NDPA diligence
What we can test
Choose one area or combine several into a single engagement.
External network
Your internet-facing servers, firewalls, email and remote access, tested from the outside.
Internal network
What an attacker or rogue insider could reach once inside your office or VPN.
Web applications and APIs
Login, payments, data handling and business logic checked against the OWASP Top 10.
Mobile applications
Android and iOS apps tested for insecure storage, weak authentication and data leaks.
Wireless networks
Office Wi-Fi and guest networks checked for weak encryption and rogue access points.
Social engineering
Phishing emails and phone tests that measure how your staff respond.
How a test runs
Clear steps, written approval and no surprises.
Scope and approval
We agree targets, timing and limits, and you sign an authorisation letter and NDA.
Discover
We map your systems and gather the information an attacker would find.
Attack
We try to break in using controlled methods, and flag any critical issue to you at once.
Report
You get ranked findings, proof and step-by-step fixes, then a debrief call.
Retest
After you fix the issues, we test again and confirm they are closed.
What you get
- Executive summary: two pages for owners and boards, in plain language
- Technical report: every finding with evidence, risk rating and fix
- Debrief session: we walk your team through the results
- Retest: verification that your fixes worked
- Compliance letter: proof of testing for auditors and partners
Questions about penetration testing
Will the test crash our systems?
We use controlled methods and agree safe limits first. Risky tests, such as those that could cause downtime, are only done with your approval and often outside working hours.
Is a penetration test the same as a vulnerability scan?
No. A scan automatically lists possible weaknesses. A penetration test has a human expert actually exploit them to prove the real risk and show how far an attacker could go.
How often should we test?
At least once a year, and again after major changes such as a new application, a cloud migration or a merger.
Will you keep our data confidential?
Yes. We sign an NDA, work only inside the approved scope, store findings securely and securely delete test data when the project ends.
Do you need our passwords or access?
It depends on the test type. We can test with no inside information, as an outsider would, or with accounts you provide to examine what a logged-in user could do.
Related services
Ready to test your defences?
Book a free scoping call and get a fixed quote.