Penetration Testing

External

Cybersecurity assessment that focuses on identifying vulnerabilities and security weaknesses from an external perspective. It simulates how potential attackers might attempt to infiltrate an organization's systems, networks, and applications.

Typically, this test includes the evaluation of internet-facing assets such as web applications, email servers, firewalls, and network infrastructure, with the goal of discovering and remediating vulnerabilities before malicious actors can exploit them.

Internal

A cybersecurity assessment conducted from within an organization's network to identify vulnerabilities and evaluate the effectiveness of internal security controls. This typically encompasses the evaluation of internal network segments, servers, databases, and applications.

The primary objective is to identify and remediate security vulnerabilities, misconfigurations, and weaknesses that could be exploited by a malicious insider or an attacker who has already gained access to the internal network, providing evidence of compliance with regulatory requirements and certifications (PCI-DSS, SWIFT-CSP, ISO27001, and others).

Wireless

Penetration testing exercise focused on discovering vulnerabilities that could lead to unauthorized access, data breaches, or interference with wireless communication. The scope of wireless network penetration testing includes the evaluation of wireless access points, controllers, routers, authentication mechanisms, encryption protocols, and the overall wireless network architecture.

Cloud

Cybersecurity assessment focused on evaluating the security of an organization's cloud infrastructure and services. It simulates attacks and vulnerabilities that can affect cloud resources, such as containers, virtual machines, storage, databases, and applications.

This exercise encompasses services and configurations, identity and access management, data storage and encryption, network security, and authentication mechanisms. The primary objective is to identify cloud environment-specific vulnerabilities that could lead to data breaches, unauthorized access, or the compromise of assets. Testing can also assess compliance with cloud security best practices and adherence to service provider security controls.

ICS/OT

Cybersecurity assessment focused on evaluating the security of Industrial Control Systems (ICS) and Operational Technology (OT) environments. It simulates attacks and vulnerabilities that can affect critical infrastructure, such as SCADA systems, PLCs, RTUs, and other industrial automation components.

This exercise encompasses industrial protocols, network segmentation, device configurations, and authentication mechanisms. The primary objective is to identify vulnerabilities specific to ICS/OT environments that could lead to operational disruptions, safety incidents, or compromise of critical infrastructure. Testing also evaluates compliance with industrial security standards and best practices, including alignment with IEC 62433.

Custom

Custom penetration testing services designed to assess the security of hardware, firmware, IoT devices, and specific communication protocols through advanced reverse engineering techniques. These engagements focus on the security of unique, often proprietary and embedded systems such as ATMs, self-service kiosks, electronic vaults, cash and check-counting machines, voting machines, industrial terminals, and other specialized smart devices.

This process involves disassembling and thoroughly analyzing device firmware and hardware to identify vulnerabilities, undocumented functionality, insecure configurations, and potential weaknesses that could be exploited in real-world attack scenarios.