Penetration testing

Penetration testing from a team that also helps you fix what it finds.

Our in house pentesters attack your systems the way a real intruder would. You get proof of each weakness, a plain fix and a retest before the finding closes.

001 Scope

Three scopes, one standard of testing.

Tell us which systems hold client data and we set the scope around them.

Web application

Logins, roles, APIs and the business logic behind them. We test what your users and an attacker can both reach.

External network

Public IP addresses, domains, firewalls and exposed services. We find what the internet can see before an attacker does.

Cloud

Accounts, storage, identity settings and the permissions that connect them. We check how your cloud is configured, not only what runs in it.

002 Method

We test against standards your auditors already know.

Each engagement follows the same published methods, so the results stand up in an audit and in a client review.

OWASP

We test web applications against the OWASP Web Security Testing Guide and the OWASP Top 10 risk categories.

PTES

The Penetration Testing Execution Standard guides each engagement from scoping and intelligence gathering through to reporting.

NIST SP 800 115

NIST SP 800 115 sets the technical process for planning, testing and analysing results in a way auditors recognise.

003 Report

Every finding comes with proof and a fix.

The report is written for two readers. Your leaders get the summary and your developers get the steps to reproduce and fix each issue.

Executive summary

The overall risk, the most serious findings and the order to fix them in.

Findings with severity

Each weakness rated by impact and likelihood, with the affected system named.

Evidence and steps

Screenshots, requests and the exact steps to reproduce each finding.

Fix guidance

A plain fix for each finding, written for the people who will make the change.

A redacted sample report will appear here.

004 Retest

We retest each fix before the finding closes.

When you say a fix is live, we test it again. A finding closes only when the retest shows the weakness is gone.

005 Your score

Findings feed your Oncrypt Score.

Each finding becomes a task in your score. A passed retest moves the score and stores the evidence in your vault.

Findings become tasks

Every open finding lowers the score in its category until the fix is confirmed.

Retests update the score

A passed retest raises the score the same day, so the gap closes on record.

Evidence goes to the vault

The report and the retest result are filed against the control they prove.

006 Our team

Our in house team runs every test.

Oncrypt's own pentesters run each engagement from start to finish. An independent audit firm issues the final audit stamp, separate from our testing.

Team profiles and credentials will appear here.

Talk to us about a test for your systems.

Tell us which systems you run and we will scope the right test for them.

Talk to us