Web applications
OWASP Top 10, logic flaws, authentication, authorization, session management, business logic abuse.
Manual, documented, with retest · Report in two layers — executive and technical
Request a quote →
Pentest · OWASP · PTES · MITRE ATT&CK
Penetration testing with a report that holds up under audit.
Manual, documented, with a retest included. We don't hand over a tool export — we hand over findings with reproduction steps, evidence, risk assessment and remediation guidance. A report that can be read by the board and executed by the technical team.
A penetration test is a manual, authorised attack on your web apps, APIs, network, cloud or mobile apps to find the weaknesses an attacker would use. KodeX GRC follows OWASP and PTES, delivers an executive and a technical report in 2–3 weeks, and includes a retest after you fix the findings.
What it covers
Six engagement types. Each has a different scope, different techniques and a different deliverable — together we choose which make sense based on your footprint.
APIs
OWASP API Top 10, broken object level authorization, mass assignment, rate limiting, authentication bypass.
Internal network
Pivoting, privilege escalation, Active Directory, lateral movement, Kerberos attacks, credential harvesting.
External perimeter
Exposed services, VPN, webmail, remote access, subdomain takeover, cloud storage exposure.
Cloud configuration
IAM policies, storage exposure, network segmentation, logging gaps, privilege escalation paths.
Mobile applications
OWASP MASVS, secure storage, communication, certificate pinning, reverse engineering resistance.
Who it's for
A pentest is worth doing when there's a real reason — a regulatory requirement, a client demand, or a serious suspicion that something isn't working as you believe.
We work primarily with organisations that already have technical controls — EDR, WAF, MFA, logging — and want to verify that those controls respond to the real threat. Not theoretically, but with attempted exploitation.
The rule: if a client asked for it, if you're going through an ISO 27001 audit (A.8.8), if PCI DSS or DORA applies to you, or if you suspect one of your applications has a serious gap — the pentest has immediate value.
SaaS and applications processing sensitive client data
Financial and fintech with regulatory requirements (DORA, PCI DSS)
Anyone with ISO 27001 needing annual evidence for A.8.8
Anyone who's had an audit finding on technical testing
Before a major change — migration, new product, acquisition, IPO
How we work
Four phases. The sequence matters — scoping precedes exploitation, and the retest comes after remediation, not alongside the first report.
Scoping
What's tested, how, under what rules
Scope definition, rules of engagement, testing windows, team communication, emergency stop contacts.
3 daysReconnaissance
Before we strike
Passive and active information gathering — attack surface, exposed assets, technologies, credentials in leaks.
2–3 daysExploitation
Manually, not automatically
Exploitation, privilege escalation, lateral movement, persistence. Every step documented with evidence, not theory.
5–10 daysReporting & retest
And verification of fixes
Executive summary for the board, technical details for the team, debrief, retest after remediation with an updated report.
4 days + retestSample finding
An anonymised excerpt from one of our reports. Every finding is delivered with this structure — reproduction steps, evidence, risk assessment, remediation.
- Description
- The endpoint
GET /api/v2/orders/{id}returns full order details without checking whether the requester owns the order. Any authenticated user can access data belonging to other customers — names, addresses, purchase history, last 4 digits of card. - Steps
-
- Sign in as user A — obtain a valid JWT
- Note user A's
order_id(10458) - Request
order_id=10459with the same JWT - The API returns
200 OKwith full data for user B
- Impact
- Confidentiality breach at scale. Triggers a notification obligation under GDPR Article 33 (within 72 hours) and possible communication to data subjects under Article 34. Exposure to fines and customer loss.
- Remediation
- Ownership check at the resource level, not just authentication. Recommendation to review all endpoints in the same category — three more with the same weakness were found during testing.
- References
- OWASP API1:2023 · CWE-639 · OWASP Top 10 A01:2021
- Description
- Service account
svc_backuphas an SPN registered and a password recovered within 4 hours using a wordlist. The account holds Domain Admin rights — full Active Directory takeover. - Evidence
- We demonstrated recovery of
NTDS.ditfrom a domain controller using the account. Evidence is delivered in a separate file with restricted access. - Remediation
- Immediate password change to 25+ characters, migration to Group Managed Service Accounts, privilege reduction, Kerberoasting detection enabled.
What you get
Six deliverables covering every stakeholder — from the board down to the engineer who'll implement the fix.
Executive summaryFor the board — what we found, how serious, what we recommend. Without technical jargon.
Technical reportEvery finding with reproduction steps, evidence, CVSS score, remediation guidance.
Risk classificationCritical / high / medium / low — reasoned on exploitability and impact.
Evidence packageScreenshots, HTTP requests/responses, command output — the evidence an auditor asks for.
Retest reportVerification of fixes after remediation — with updated status per finding.
Debrief presentationWith the technical team, with Q&A — and, if needed, with the board.
Timeline — 2 to 3 weeks
Typical web application or internal network engagement. Exploitation time scales with scope — scoping defines it precisely.
WK 01
Scoping & reconnaissance
Rules of engagement, attack surface, passive and active information gathering.
WK 02
Exploitation
Manual exploitation, privilege escalation, lateral movement, persistence.
WK 03
Reporting & debrief
Writing, internal peer review, delivery, debrief with technical team and board.
+2 wks
Retest
Verification of fixes, updated report, closure.
Frequently asked
The questions we hear before taking on a penetration testing engagement.
What's the difference between pentest and vulnerability assessment?
VA scans automatically and ranks the findings. Pentest exploits, with human judgement, to prove what's actually exploitable. Usually you need both — VA for continuous coverage, pentest for proof in depth. See the next step on the Vulnerability Assessment page.
How long does a penetration test take?
Typically 2–3 weeks of testing. Depends on scope — one web application is 5–7 days, an internal network for 250 people is 10–15 days. The two weeks after are for reporting and retest.
Will production be affected during the pentest?
Not with proper scoping. Exploitation attempts happen in agreed windows, with test accounts where possible, and with an immediate stop procedure in place. If anything presents a production risk, we tell you immediately and stop.
How much does a pentest cost?
It depends on scope. A web application pentest starts at a few thousand euros. After scoping we give a fixed price — not before. We don't quote without seeing the footprint, because phone quotes are always wrong.
Do we need ISO 27001 to have a pentest?
No. A pentest has independent value — it shows you what's actually exploitable. If you have ISO 27001, the pentest evidence satisfies A.8.8 (management of technical vulnerabilities). If not, the pentest is a good starting point to build a program around.
Related services
A pentest rarely stands alone. It usually combines with the following, because they share findings and evidence.
06 · VA
Continuous assessment
A pentest is a snapshot — once a year. VA fills the gap between tests with continuous scanning and prioritisation.
01 · ISO 27001A.8.8 · Evidence
Pentest evidence satisfies the technical vulnerability management requirement — and produces the evidence the auditor asks for.
07 · CloudBefore the pentest
Cloud misconfigurations show up as findings in every pentest. Better to close them before the test begins.
Get started
Tell us what you want us to test.
In one short scoping call — 10 minutes — we define scope, rules of engagement, and timeline together. You get a fixed quote with a specific number of days and deliverables. No commitment.
No commitment
Confidential
NDA before scoping