Penetration Testing

An Infrastructure Penetration Test uncovers vulnerabilities residing within your infrastructure and provides a detailed attack narrative to help evaluate the impacts of each finding.

​

• A thorough foundational assessment of networks and systems

• Identify all paths to Domain Admin

• System hardening recommendations

• OS and third-party patching assessment

• Identify insecure configurations within on-prem and cloud environments

• Uncover the impacts of techniques, tactics, and procedures commonly used by ransomware

• A comprehensive report with detailed findings and remediation steps

Ransomware penetration testing evaluates the preparedness and risk of a ransomware attack. Our comprehensive assessment identifies gaps in people, processes, and technology, to determine the likelihood and readiness for a ransomware attack. In addition to a complete analysis of the security program against the Cybersecurity Framework Profile for Ransomware Risk Management (NISTIR 8374), and a technical assessment of security controls, a full penetration test is conducted to measure the robustness of your systems. 
 

• Technical components assessment

• Non-technical components assessment

• Thorough Foundational Assessment of Networks and Systems

• System hardening recommendations

• A comprehensive report with detailed findings and remediation steps

The Objective-Based Penetration Test (OBPT) is a bundle that includes our thorough Infrastructure Penetration Testing service offering. OBPT adds context and specific testing for  more goal-oriented security. Define your goals, such as gaining access to your most critical data or domain admin, and our ethical hackers will provide a narrative of how an attack was carried out and the methods used. This will enable your in-house team to identify and address any security vulnerabilities. OBPT is a comprehensive penetration test that includes adversary simulation for added security assistance.
 

• Social engineering scoped to your preferences (phishing, vishing, tailgating, device drops)

• Active directory assessment to identify weaknesses in passwords and configurations

• Ransomware assessment that will identify potential impacts of a ransomware attack with the current configuration and security controls

• A thorough penetration test across your infrastructure

A Cloud Penetration test uncovers vulnerabilities residing within your cloud infrastructure and provides a detailed attack narrative to help evaluate the impacts of each finding. Our Cloud Penetration Testing methodology is 95% manual and is derived from the SANS Pentest Methodology, the MITRE ATT&CK framework for enterprises, Azure Threat Research Matrix and NIST SP800-115 to ensure compliance with most regulatory requirements. 
 

• Serverless cloud testing for Lambda, Azure Function, and Google Cloud Functions

• Simulation of an attack scenario on your cloud environment

• A GIAC Cloud Penetration Tester (GCPN)

• Robust testing against AWS, Azure, and Google cloud service infrastructure that includes:

  • Cloud virtual infrastructure

  • Containers and pods

  • Identity and access management (IAM) 

  • Externally accessible exposures