--- title: "Penetration testing for companies | Daniel Christensen" description: "Penetration testing of web applications, APIs, infrastructure and cloud, plus phishing tests. Manual testing, a report you can act on, retest included. Fixed price, NDA on day one." canonical_url: "https://danielchristensen.no/en/pentest" last_updated: "2026-09-07T12:05:02.308Z" locale: en meta: "og:description": "Penetration testing of web applications, APIs, infrastructure and cloud, plus phishing tests. Manual testing, a report you can act on, retest included. Fixed price, NDA on day one." "og:image": "https://danielchristensen.no/_og/d/c_Default%2Ctitle_Pentesting.%2Csubtitle_Find%2Bthe%2Bholes%2Bbefore%2Banyone%2Belse%2Bdoes.%2Ctagline_~RXRoaWNhbCBoYWNrZXIgwrcgU3BlYWtlcg%2Cmascot_hacker-1%2Cp_Ii9lbi9wZW50ZXN0Ig%2Cs_S4cqJTIz3WmVhqZW.png" "og:image:height": "600" "og:image:type": image/png "og:image:width": "1200" "og:title": "Penetration testing for companies" "twitter:image": "https://danielchristensen.no/_og/d/c_Default%2Ctitle_Pentesting.%2Csubtitle_Find%2Bthe%2Bholes%2Bbefore%2Banyone%2Belse%2Bdoes.%2Ctagline_~RXRoaWNhbCBoYWNrZXIgwrcgU3BlYWtlcg%2Cmascot_hacker-1%2Cp_Ii9lbi9wZW50ZXN0Ig%2Cs_S4cqJTIz3WmVhqZW.png" --- > Index of every page on this site: [llms.txt](https://danielchristensen.no/llms.txt) Pentesting # A penetration test of what you actually run. I attack your systems the way a criminal would, with written permission, and deliver a report that says what is wrong, how serious it is and exactly how to fix it. Not a scanner dump with 400 findings, but what actually matters. Web apps and APIsInfrastructure and cloudPhishing and social engineeringRetest included [Book a call →](https://danielchristensen.no/en/contact?type=pentest) [Try the domain check for free](https://danielchristensen.no/en/tools/domain-check) What you get ## A test you can act on. - **Agreement and NDA before anything happens**We agree in writing what will be tested, when, and what I am allowed to do once I get in. The NDA is signed before you send me anything at all. - **Manual testing, not just scanning**Tools find the known. I use them, then spend the time on logic flaws, access control and the chains of small mistakes scanners never see. - **A report that prioritises**Every finding with severity, evidence and a concrete fix, sorted by risk. A one-page summary for management, the details for whoever does the fixing. - **A walkthrough with the team**I go through the report with the developers and management, so nobody has to guess what a finding means or where to start. - **Retest once you have fixed it**When the holes are closed I test again and confirm in writing what is fixed. That confirmation is what auditors and customers ask for. What I test ## Where the attacks actually come from. ### Web applications Login, access control, injection and business logic. What your customers and staff use every day. ### APIs Authentication, authorisation, rate limiting and what leaks when the client is not a browser. ### Internal infrastructure Networks, Active Directory, old servers and everything that just sits there. Often the path from one laptop to the whole domain. ### Cloud and Microsoft 365 Misconfigurations in Azure, AWS and Microsoft 365: open storage, weak conditional access and forgotten apps with too many rights. ### Phishing and social engineering Targeted emails, phone calls and visits, agreed in advance. Measures how easily people let me in, without shaming anyone. ### Code security review A review of code and pipeline together with the team, based on the mistakes I keep finding in pentests. 2 to 4 weekstypical delivery, from agreement to report OWASP + own methodbest practice plus ten years of own findings NDA on day onebefore you send me anything sensitive How it works ## Five steps, from first call to confirmed fix. - **Scoping call**A 20-minute conversation about what you have, what you worry about and what is urgent. Afterwards you get a fixed price. - **Scope and agreement**We set the boundaries: which systems, which time window, and who gets called if I find something critical in the middle of the night. - **Testing**Usually one to two weeks. I work to OWASP and my own method, and flag anything serious enough that it should not wait for the report. - **Report and walkthrough**The report is delivered and walked through in a meeting. Technical detail for the developers, the risk picture for management. - **Retest**You fix, I test again, and you get written confirmation of what is closed. Requirements and frameworks ## Documentation you can show. - **NIS2 and ISO 27001**An independent test and a retest are evidence that security work is done, not just described. The report is written to be attached to an audit. - **OWASP Top 10 and ASVS**Web tests are mapped to OWASP Top 10 and ASVS, so you can show what is covered and what is not. - **Fixed price**The price is set after the scoping call and it is fixed. No running hours. Schools and non-profits get a discount. - **Start for free**My domain check shows in a minute what is visible about your domain from the outside. Run it before we talk. Questions about pentesting ## What companies ask
before they order. ![Hacker illustration](https://danielchristensen.no/_nuxt/mvewcfdo/hacker-1.CYhdT60T.svg) It depends on the scope. A contained web application is a few days, a full test of infrastructure and cloud is several weeks. After a 20-minute scoping call you get a fixed price, and it holds. Next step ## Want to know where you stand? Send a few lines about what you have and what worries you. I reply the same day with a proposed scope and a fixed price. [Book a call →](https://danielchristensen.no/en/contact?type=pentest) [Try the domain check for free](https://danielchristensen.no/en/tools/domain-check) 01Choose dates 02Tell me about the job 03I reply the same day Preferred dates ## When works for you? Click every date that could work, one or several alternatives. The more you mark, the easier it is to find a day that suits us both. October 2026 Mon Tue Wed Thu Fri Sat Sun Available Busy Selected ```json {"@context":"https://schema.org","@graph":[{"@id":"https://danielchristensen.no/en#website","@type":"WebSite","description":"Ethical hacker and keynote speaker. Talks on digital security, pentesting and how to avoid getting hacked.","inLanguage":"en","name":"Daniel Christensen","url":"https://danielchristensen.no/en","publisher":{"@id":"https://danielchristensen.no/#identity"},"translationOfWork":{"@id":"https://danielchristensen.no/#website"}},{"@id":"https://danielchristensen.no/en/pentest#webpage","@type":"WebPage","description":"Penetration testing of web applications, APIs, infrastructure and cloud, plus phishing tests. Manual testing, a report you can act on, retest included. Fixed price, NDA on day one.","name":"Penetration testing for companies","url":"https://danielchristensen.no/en/pentest","breadcrumb":{"@id":"https://danielchristensen.no/en/pentest#/schema/breadcrumb-list/#breadcrumb"},"isPartOf":{"@id":"https://danielchristensen.no/en#website"},"mainEntity":{"@id":"https://danielchristensen.no/pentest#service"},"potentialAction":[{"@type":"ReadAction","target":["https://danielchristensen.no/en/pentest"]}]},{"@id":"https://danielchristensen.no/#identity","@type":"Person","alternateName":"BobTheShoplifter","description":"Ethical hacker, speaker and content creator (BobTheShoplifter). Talks on digital security and pentesting.","name":"Daniel Christensen","url":"https://danielchristensen.no","address":{"@type":"PostalAddress","addressLocality":"Oslo","addressRegion":"Oslo","addressCountry":"NO"},"contactPoint":{"@type":"ContactPoint","telephone":"+4798332280","email":"daniel@websecured.io","contactType":"booking","areaServed":"NO","availableLanguage":["nb","en"]},"image":{"@id":"https://danielchristensen.no/#/schema/image/1"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"FollowAction"},"userInteractionCount":130500},"jobTitle":["Ethical hacker","Keynote speaker","Content creator"],"knowsAbout":["Digital security","Cybersecurity","Ethical hacking","Penetration testing","Social engineering","Fraud and phishing"],"sameAs":["https://www.wikidata.org/wiki/Q109401760","https://www.tiktok.com/@bobtheshoplifter","https://www.instagram.com/bobtheshoplifter","https://www.youtube.com/channel/UCp2mLClUy4kwbg_uUWbR_5w","https://www.linkedin.com/in/-daniel-/","https://twitter.com/BobTShoplifter","https://www.facebook.com/daniel.christensen.5648/"],"worksFor":{"@type":"Organization","name":"Websecured","url":"https://websecured.io"}},{"@id":"https://danielchristensen.no/en/pentest#/schema/breadcrumb-list/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://danielchristensen.no/en","position":1},{"@type":"ListItem","name":"Pentesting","item":"https://danielchristensen.no/en/pentest","position":2}]},{"@id":"https://danielchristensen.no/pentest#service","@type":"Service","description":"Penetration testing of web applications, APIs, infrastructure and cloud, plus phishing tests. Manual testing, a report you can act on, retest included. Fixed price, NDA on day one.","name":"Penetration testing and ethical hacking","serviceType":"Penetrasjonstesting","areaServed":{"@type":"Country","name":"Norway"},"availableChannel":{"@type":"ServiceChannel","serviceUrl":"https://danielchristensen.no/en/pentest","availableLanguage":["nb","en"]},"hasOfferCatalog":{"@type":"OfferCatalog","name":"Where the attacks actually come from.","itemListElement":[{"@type":"Offer","itemOffered":{"@type":"Service","name":"Web applications","description":"Login, access control, injection and business logic. What your customers and staff use every day."}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"APIs","description":"Authentication, authorisation, rate limiting and what leaks when the client is not a browser."}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"Internal infrastructure","description":"Networks, Active Directory, old servers and everything that just sits there. Often the path from one laptop to the whole domain."}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"Cloud and Microsoft 365","description":"Misconfigurations in Azure, AWS and Microsoft 365: open storage, weak conditional access and forgotten apps with too many rights."}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"Phishing and social engineering","description":"Targeted emails, phone calls and visits, agreed in advance. Measures how easily people let me in, without shaming anyone."}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"Code security review","description":"A review of code and pipeline together with the team, based on the mistakes I keep finding in pentests."}}]},"provider":{"@id":"https://danielchristensen.no/#identity"}},{"@id":"https://danielchristensen.no/en/pentest#faq","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What does a penetration test cost?","acceptedAnswer":{"@type":"Answer","text":"It depends on the scope. A contained web application is a few days, a full test of infrastructure and cloud is several weeks. After a 20-minute scoping call you get a fixed price, and it holds."}},{"@type":"Question","name":"Is it safe to let you test production?","acceptedAnswer":{"@type":"Answer","text":"Yes, when it is agreed. We set a time window, I avoid anything that could take the service down, and you have a number to call the whole way. Destructive tests are never run without explicit agreement."}},{"@type":"Question","name":"What is the difference between vulnerability scanning and a pentest?","acceptedAnswer":{"@type":"Answer","text":"Scanning is automatic and finds the known. A pentest is a person trying to break in, chaining findings together and showing what is actually possible. You need both, but the pentest is what shows the risk."}},{"@type":"Question","name":"How often should we test?","acceptedAnswer":{"@type":"Answer","text":"At least yearly, and after major changes. Many choose one full test a year plus a smaller test whenever something new goes into production."}},{"@type":"Question","name":"Can we test phishing without staff feeling caught out?","acceptedAnswer":{"@type":"Answer","text":"Yes. Results are reported at group level, nobody is singled out, and I am happy to give a talk for the staff afterwards, so the test becomes learning rather than punishment."}}]},{"@id":"https://danielchristensen.no/#/schema/image/1","@type":"ImageObject","contentUrl":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg","inLanguage":"en","url":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg"}]} ``` ## Sitemap See the full [sitemap](https://danielchristensen.no/sitemap.md) for all pages.