Pentesting

A penetration test of what you actually run.

Q: Is it safe to let you test production?

Yes, when it is agreed. We set a time window, I avoid anything that could take the service down, and you have a number to call the whole way. Destructive tests are never run without explicit agreement.

Q: What is the difference between vulnerability scanning and a pentest?

Scanning is automatic and finds the known. A pentest is a person trying to break in, chaining findings together and showing what is actually possible. You need both, but the pentest is what shows the risk.

Q: How often should we test?

At least yearly, and after major changes. Many choose one full test a year plus a smaller test whenever something new goes into production.

Q: Can we test phishing without staff feeling caught out?

Yes. Results are reported at group level, nobody is singled out, and I am happy to give a talk for the staff afterwards, so the test becomes learning rather than punishment.

I attack your systems the way a criminal would, with written permission, and deliver a report that says what is wrong, how serious it is and exactly how to fix it. Not a scanner dump with 400 findings, but what actually matters.

Web apps and APIsInfrastructure and cloudPhishing and social engineeringRetest included

Book a call →Try the domain check for free

What you get

A test you can act on.

Agreement and NDA before anything happensWe agree in writing what will be tested, when, and what I am allowed to do once I get in. The NDA is signed before you send me anything at all.
Manual testing, not just scanningTools find the known. I use them, then spend the time on logic flaws, access control and the chains of small mistakes scanners never see.
A report that prioritisesEvery finding with severity, evidence and a concrete fix, sorted by risk. A one-page summary for management, the details for whoever does the fixing.
A walkthrough with the teamI go through the report with the developers and management, so nobody has to guess what a finding means or where to start.
Retest once you have fixed itWhen the holes are closed I test again and confirm in writing what is fixed. That confirmation is what auditors and customers ask for.

What I test

Where the attacks actually come from.

Web applications

APIs

Authentication, authorisation, rate limiting and what leaks when the client is not a browser.

Internal infrastructure

Networks, Active Directory, old servers and everything that just sits there. Often the path from one laptop to the whole domain.

Cloud and Microsoft 365

Misconfigurations in Azure, AWS and Microsoft 365: open storage, weak conditional access and forgotten apps with too many rights.

Phishing and social engineering

Targeted emails, phone calls and visits, agreed in advance. Measures how easily people let me in, without shaming anyone.

Code security review

A review of code and pipeline together with the team, based on the mistakes I keep finding in pentests.

2 to 4 weekstypical delivery, from agreement to report

OWASP + own methodbest practice plus ten years of own findings

NDA on day onebefore you send me anything sensitive

How it works

Five steps, from first call to confirmed fix.

Scoping callA 20-minute conversation about what you have, what you worry about and what is urgent. Afterwards you get a fixed price.
Scope and agreementWe set the boundaries: which systems, which time window, and who gets called if I find something critical in the middle of the night.
TestingUsually one to two weeks. I work to OWASP and my own method, and flag anything serious enough that it should not wait for the report.
Report and walkthroughThe report is delivered and walked through in a meeting. Technical detail for the developers, the risk picture for management.
RetestYou fix, I test again, and you get written confirmation of what is closed.

Requirements and frameworks

Documentation you can show.

NIS2 and ISO 27001An independent test and a retest are evidence that security work is done, not just described. The report is written to be attached to an audit.
OWASP Top 10 and ASVSWeb tests are mapped to OWASP Top 10 and ASVS, so you can show what is covered and what is not.
Fixed priceThe price is set after the scoping call and it is fixed. No running hours. Schools and non-profits get a discount.
Start for freeMy domain check shows in a minute what is visible about your domain from the outside. Run it before we talk.

Questions about pentesting

What companies ask
before they order.

What does a penetration test cost?

It depends on the scope. A contained web application is a few days, a full test of infrastructure and cloud is several weeks. After a 20-minute scoping call you get a fixed price, and it holds.

Is it safe to let you test production?

What is the difference between vulnerability scanning and a pentest?

How often should we test?

Can we test phishing without staff feeling caught out?

Next step

Want to know where you stand?

Send a few lines about what you have and what worries you. I reply the same day with a proposed scope and a fixed price.

Book a call →Try the domain check for free

01Choose dates

02Tell me about the job

03I reply the same day

Preferred dates

When works for you?

Click every date that could work, one or several alternatives. The more you mark, the easier it is to find a day that suits us both.

October 2026

Mon

Tue

Wed

Thu

Fri

Sat

Sun

Available Busy Selected