Get a penetration test

What exactly is a pentest?

A pentest, also known as a penetration test or ethical hacking engagement, is a security assessment in which certified ethical hackers test your systems and applications for vulnerabilities. In the same way malicious hackers would. The goal is to identify and fix weaknesses before they can be exploited.

Which pentest do I need?

That depends on the objective of the pentest, your risk profile and the systems you want assessed. For example, do you want to assess a new application, identify potential attack paths or provide evidence of technical security for an audit? Together with the sensitivity of your data and the potential consequences of exploitation, this determines the components, test scenarios and depth of testing required.

A web application pentest may be appropriate for a web application or SaaS platform, a network and cloud pentest for your IT infrastructure, and an OT security pentest for industrial environments. During scoping, we recommend the assessment or combination of assessments that best fits your objectives and risks.

Which pentest helps reduce the risk of ransomware?

A network and cloud pentest is often a suitable starting point. An external pentest examines potential entry points from the internet. An internal pentest examines what an attacker who already has access could reach, for example through a compromised user account. We assess access permissions, network segmentation and access to critical systems.

We tailor the assessment to your risk profile and IT environment. You receive practical recommendations to interrupt attack paths and limit potential damage. No pentest can fully prevent ransomware: fixing vulnerabilities, strong access controls, monitoring and tested, protected backups remain essential.

How long does a pentest take?

Active testing time ranges from 16 hours for a small web application to 80 hours or more for a large network or enterprise web app pentest. Total duration from scoping conversation to final report is typically 4 to 8 weeks.

What is the difference between a pentest and a vulnerability scan?

A vulnerability scan largely automates checks for known vulnerabilities and configuration errors. A pentest adds manual investigation, for example of business logic, authorization and combinations of vulnerabilities. The choice depends on your objectives, risk profile and any specific audit or contractual requirements. A scan does not replace a pentest where one is explicitly required.

How often should I have a pentest performed?

This depends on your risk profile, changes to your systems and any audit or contractual requirements. Annual testing can be a useful starting point, with additional assessments after significant changes. This is not a universal legal pentest requirement. DigiD requires an annual ICT security assessment; align the pentest and follow-up with the applicable requirements.

Will a pentest disrupt our production environment?

We prefer to work on acceptance or test environments. Where production testing is necessary, we make strict safety agreements about timing, impact limits and escalation paths. Our testers know how to work without disruption.

What about compliance mapping?

We can map findings to the relevant technical requirements of your framework, for example for NIS2, ISO 27001 or DigiD. We agree the requirements, systems and reporting components in scope beforehand. The report provides technical evidence for your auditor, but is not a certification or a guarantee that your organization meets every requirement.