Penetration Testing

Penetration testing across six attack surfaces

Expert-led penetration testing for web applications, APIs, mobile apps, cloud environments, networks, and Wi-Fi. We combine hands-on testing with recognised OWASP, PTES, and NIST methodologies to uncover real risks and help you fix them.

Estimate my pentest

Glowing orange mechanical bee emerging from a hole in a dark hexagonal honeycomb floor

Passeca delivers penetration tests across web applications, APIs, mobile apps, cloud environments, networks, and Wi-Fi to help you identify and address security risks. Each test follows a structured five-phase process based on recognised methodologies (OWASP WSTG, MASTG, PTES, and NIST SP 800-115), from vulnerability discovery to verified fixes. The result is a clear, actionable report that helps you improve security and support PCI DSS, ISO 27001, SOC 2, DORA, and NIS2 compliance.

Web Applications
APIs
Mobile Apps
Cloud
Network
Wi-Fi

What we test

Choose the systems you want to test

Every system has its own security risks. Our six penetration testing services follow recognised methodologies and focus on the vulnerabilities specific to each environment. Explore each service to see what we test, how we test it, example findings, expected timelines, and relevant compliance requirements.

Web Application

We test for OWASP Top 10 risks, including broken access controls, injection attacks, authentication flaws, and business-logic vulnerabilities.

Broken access control
Injection (SQLi/XSS)
SSRF
Authentication failures

Web Application testing

API

Protect the connections your applications rely on. We test REST and GraphQL APIs for unauthorised access (BOLA), sensitive data exposure, unsafe data updates, rate-limiting weaknesses, and injection attacks.

BOLA
Excess data exposure
Mass assignment
Rate limiting

API testing

Mobile (Android / iOS)

Following OWASP MASTG, we assess data storage, encryption, certificate pinning, and how securely your app communicates and handles sensitive information.

Insecure storage
Certificate pinning bypass
Insecure IPC
Client-side trust

Mobile (Android / iOS) testing

Cloud (AWS / Azure / GCP)

We examine permissions and access controls (IAM), publicly exposed services, containers, Kubernetes, and vulnerabilities that could reveal sensitive cloud information.

IAM misconfig
Exposed services
Container / K8s
SSRF to metadata

Cloud (AWS / Azure / GCP) testing

Network

We test internal and external systems for outdated services, weak credentials, lateral movement opportunities, and Active Directory privilege escalation.

Unpatched services
Weak credentials
Lateral movement
Domain escalation

Network testing

Wi-Fi

We assess Wi-Fi encryption, rogue access points, Evil Twin attacks, and whether guest networks are properly isolated from critical systems.

Weak ciphers (WPA2/3)
Rogue APs
Evil Twin
Guest-network isolation

Wi-Fi testing

Methodology

Penetration testing built on proven methodologies

We follow proven industry standards tailored to each system and clearly document our approach, so you know exactly what we test and how.

OWASP WSTG

Web applications

Web Security Testing Guide — the application-layer methodology.

OWASP MASTG

Mobile apps

Mobile Application Security Testing Guide — Android and iOS.

PTES

All asset types

Penetration Testing Execution Standard — the end-to-end engagement framework.

NIST SP 800-115

Network & systems

Technical guide to security testing and assessment.

Sample report

See what a real pentest report looks like

What does a penetration test actually deliver? See for yourself. Explore a real, anonymised Passeca report with documented findings, supporting evidence, and practical recommendations to help your team fix what’s vulnerable.

Inside the sample report

No vague warnings or endless technical jargon. The report includes an executive summary, CVSS severity ratings, business impact, supporting evidence, reproduction steps, and clear remediation guidance for developers.

Our process

Your penetration test, explained in five steps

Our five-phase penetration testing process takes you from the initial scope to the final verification of fixes. Explore each phase to understand what we test, how we identify risks, and what results you can expect.

01
Define the scope
We agree on which systems to test, the relevant test types, success criteria, and testing schedule. We also establish clear authorisation and rules of engagement, so you know exactly what’s included and excluded before the test begins.
02
Map potential attack paths
We map your attack surface, including endpoints, services, identities, and trust boundaries, to understand where attackers could find a way in. We then build a threat model to focus our tests on the areas attackers are most likely to target. For cloud and network environments, we also identify exposed services and examine relationships between identities.
03
Find and validate vulnerabilities
We manually test for vulnerabilities according to recognised standards (OWASP WSTG, MASTG, PTES, and NIST SP 800-115). We assess individual weaknesses and how attackers could combine them to gain privileged access or reach sensitive data, which helps us identify the real business risks.
04
Understand the risks and how to fix them
We provide a detailed report that explains each vulnerability, its CVSS severity score, and its potential impact on your business. Your developers get evidence, steps to reproduce the issues, and practical recommendations for what to fix first. Your leadership and auditors also receive a clear executive summary.
05
Verify the fixes
Once your team addresses the findings, we retest the affected areas within the agreed engagement window to check that the vulnerabilities have been resolved. You’ll receive documented results to support your internal security and compliance efforts.

Five penetration testing phases: 01 define the scope, 02 map attack paths, 03 find and validate vulnerabilities, 04 understand risks and fixes, 05 verify the fixes

Certified expertise

Tested by certified offensive-security engineers

Your security deserves more than a checklist. Our certified security specialists combine hands-on testing expertise with recognised industry qualifications to find and assess vulnerabilities that matter.

Offensive Security Certified Professional — OffSec

Offensive Security Experienced Penetration Tester — OffSec

Certified Information Systems Security Professional — ISC2

Certified Information Systems Auditor — ISACA

AWS Certified Security – Specialty — Amazon Web Services

FAQ

Penetration testing, answered

The most common questions about scoping, methodology, timing, cost and compliance.

What is penetration testing?

Penetration testing is an authorised, simulated cyberattack against a defined target — a web application, API, mobile app, cloud environment, network or Wi-Fi infrastructure — to find exploitable vulnerabilities before real attackers do. Each finding comes with evidence, an assessment of its impact, and practical recommendations for fixes.

What methodology does Passeca use?

Passeca follows recognised security standards suited to each test. These include OWASP WSTG for web applications, OWASP MASTG for mobile apps, PTES for the overall penetration test process, and NIST SP 800-115 for networks and systems. We agree on the methodology before the test and document it in the final report.

How is penetration testing different from vulnerability scanning?

Vulnerability scanning uses automated tools to detect potential security weaknesses. Penetration testing goes further. Our experts manually investigate vulnerabilities, safely attempt to exploit them, and assess how attackers could combine multiple weaknesses. This helps you understand which issues pose a real threat to your business.

How long does a penetration test take?

The timeline depends on the number, type, and complexity of the systems you need to test. A focused web application or API test may take a few days, while larger cloud or network assessments can take one to two weeks or longer. Use our free pentest scoping tool to get an initial time estimate.

How much does a penetration test cost?

The cost depends on the number of assets, their complexity, and the depth of the test. We calculate the price based on the estimated effort, whether the test uses a black-box, grey-box, or white-box approach. Our free pentest scoping tool gives you an initial time estimate and price range.

Which compliance frameworks require penetration testing?

PCI DSS requires penetration tests at least annually and after significant changes. Testing also helps demonstrate security controls under ISO 27001, SOC 2, DORA, and NIS2. However, requirements vary by framework and organisation. Our reports provide documented results and remediation evidence to support your compliance efforts.

Do you test black-box, grey-box or white-box?

Yes, we offer all three approaches. Black-box tests simulate an external attacker with no prior knowledge. Grey-box tests use limited access or system information, while white-box tests provide full technical visibility, including source code and documentation. We help you choose the right approach based on your systems and security goals.

Will a penetration test disrupt my production systems?

We plan every test to minimise disruption to your operations. Before the test, we agree on its scope, schedule, and rules of engagement. We avoid destructive techniques in production and coordinate any activity that could affect your systems. For sensitive environments, we can use staging systems or schedule tests outside business hours.

What does the report include?

You receive an executive summary, detailed vulnerability findings, CVSS severity scores, business impact assessments, technical evidence, and clear recommendations for fixes. The report also documents the test scope and methodology. Once your team addresses the findings, we retest the fixes within the agreed engagement window and document the results.

What are the main types of penetration testing?

Penetration tests focus on different parts of your IT environment. Passeca offers six types: web application, API, mobile app, cloud, network, and Wi-Fi penetration testing. Each targets vulnerabilities specific to that system and follows relevant security methodologies.

How do I know what to include in a penetration test?

Start with your most critical systems, sensitive data, and external entry points. The right scope depends on your infrastructure, business risks, and compliance requirements. Our free pentest scoping tool helps you define the assets to test and estimate the time and cost involved.

Does penetration testing use manual or automated techniques?

Effective penetration testing combines both. Automated tools help detect known vulnerabilities and exposed services. Our experts then use manual techniques to validate findings, uncover business-logic flaws, and test how attackers could exploit multiple weaknesses together.

Is penetration testing suitable for small businesses and startups?

Yes. Penetration testing can be tailored to the size, complexity, and security needs of your business. A smaller engagement may focus on a critical web application, API, or cloud environment. We help you prioritise the most relevant assets and choose a scope that fits your risks and budget.

Start with a clear scope

Get a time and cost estimate for your penetration test

Tell us which systems you need tested, and our free pentest scoping tool will estimate the time and cost. Passeca’s security experts will then review your requirements and provide a tailored quote.