--- title: "Penetration testing for companies | Daniel Christensen" canonical_url: "https://danielchristensen.no/en/pentest" last_updated: "2026-09-07T12:05:02.308Z" locale: en meta: description: "Penetration testing of web applications, APIs, infrastructure and cloud, plus phishing tests. Manual testing, a report you can act on, retest included. Fixed price, NDA on day one." "og:description": "Penetration testing of web applications, APIs, infrastructure and cloud, plus phishing tests. Manual testing, a report you can act on, retest included. Fixed price, NDA on day one." "og:title": "Penetration testing for companies" --- Pentesting # A penetration test of what you actually run. I attack your systems the way a criminal would, with written permission, and deliver a report that says what is wrong, how serious it is and exactly how to fix it. Not a scanner dump with 400 findings, but what actually matters. Web apps and APIsInfrastructure and cloudPhishing and social engineeringRetest included [Book a call →](https://danielchristensen.no/en/contact?type=pentest) [Try the domain check for free](https://danielchristensen.no/en/tools/domain-check) What you get ## A test you can act on. - **Agreement and NDA before anything happens**We agree in writing what will be tested, when, and what I am allowed to do once I get in. The NDA is signed before you send me anything at all. - **Manual testing, not just scanning**Tools find the known. I use them, then spend the time on logic flaws, access control and the chains of small mistakes scanners never see. - **A report that prioritises**Every finding with severity, evidence and a concrete fix, sorted by risk. A one-page summary for management, the details for whoever does the fixing. - **A walkthrough with the team**I go through the report with the developers and management, so nobody has to guess what a finding means or where to start. - **Retest once you have fixed it**When the holes are closed I test again and confirm in writing what is fixed. That confirmation is what auditors and customers ask for. What I test ## Where the attacks actually come from. ### Web applications Login, access control, injection and business logic. What your customers and staff use every day. ### APIs Authentication, authorisation, rate limiting and what leaks when the client is not a browser. ### Internal infrastructure Networks, Active Directory, old servers and everything that just sits there. Often the path from one laptop to the whole domain. ### Cloud and Microsoft 365 Misconfigurations in Azure, AWS and Microsoft 365: open storage, weak conditional access and forgotten apps with too many rights. ### Phishing and social engineering Targeted emails, phone calls and visits, agreed in advance. Measures how easily people let me in, without shaming anyone. ### Code security review A review of code and pipeline together with the team, based on the mistakes I keep finding in pentests. 2 to 4 weekstypical delivery, from agreement to report OWASP + own methodbest practice plus ten years of own findings NDA on day onebefore you send me anything sensitive How it works ## Five steps, from first call to confirmed fix. - **Scoping call**A 20-minute conversation about what you have, what you worry about and what is urgent. Afterwards you get a fixed price. - **Scope and agreement**We set the boundaries: which systems, which time window, and who gets called if I find something critical in the middle of the night. - **Testing**Usually one to two weeks. I work to OWASP and my own method, and flag anything serious enough that it should not wait for the report. - **Report and walkthrough**The report is delivered and walked through in a meeting. Technical detail for the developers, the risk picture for management. - **Retest**You fix, I test again, and you get written confirmation of what is closed. Requirements and frameworks ## Documentation you can show. - **NIS2 and ISO 27001**An independent test and a retest are evidence that security work is done, not just described. The report is written to be attached to an audit. - **OWASP Top 10 and ASVS**Web tests are mapped to OWASP Top 10 and ASVS, so you can show what is covered and what is not. - **Fixed price**The price is set after the scoping call and it is fixed. No running hours. Schools and non-profits get a discount. - **Start for free**My domain check shows in a minute what is visible about your domain from the outside. Run it before we talk. Questions about pentesting ## What companies ask
before they order. ![Hacker illustration](https://danielchristensen.no/_nuxt/mv0saeg5/hacker-1.CYhdT60T.svg) It depends on the scope. A contained web application is a few days, a full test of infrastructure and cloud is several weeks. After a 20-minute scoping call you get a fixed price, and it holds. Next step ## Want to know where you stand? Send a few lines about what you have and what worries you. I reply the same day with a proposed scope and a fixed price. [Book a call →](https://danielchristensen.no/en/contact?type=pentest) [Try the domain check for free](https://danielchristensen.no/en/tools/domain-check) 01Choose dates 02Tell me about the job 03I reply the same day Preferred dates ## When works for you? Click every date that could work, one or several alternatives. The more you mark, the easier it is to find a day that suits us both. October 2026 Mon Tue Wed Thu Fri Sat Sun Available Busy Selected ## Sitemap See the full [sitemap](/sitemap.md) for all pages.