Vulnerability Assessment identifies vulnerabilities without exploiting them. It uses automated tools to scan the application, system or networks, is broad and shallow and is usually performed regularly.

Penetration Test uses both automated tools and manual techniques to exploit the vulnerabilities or any types of security gaps that have not yet been discovered. It is usually done annually or after major changes to the application or infra.

Our web application pentest include both VA and PT. 

Yes, it is done at least once a year or after significant changes to the infra, applications or network.

This is due to the evolving threat landscape, frequent changes in the application, for compliance requirements, identifying security gaps and risk management.

To help business save cost, we provide discount for repeat testing.

Our pentest package is comprehensive. We understand that not all companies require in depth pentest which can be quite costly especially if you have a simple website but required pentest for regulatory purpose. You can choose from basic to in depth pentest depending on your scope. If you are not sure, or none of them suits you, feel free to reach out to us.

Our penetration tests are planned and coordinated to avoid any disruption. We will work out a mutually agreed schedule and will only start with your authorization. For best practice, we recommend our clients to target a test environment if possible or backup the data before pentesting.

The duration of pentest varies depending on the scope. Below are the estimated duration (exclude report writing) for the different packages:

1. Lite : ~ 2 to 3 days
2. Essential :  ~ 1 week
3. Enterprise: ~ 2 weeks

Yes, we offer a free evaluation where we identify first vulnerability without providing a detailed report. This allows you to understand the value of our services and see the potential security improvements.

There are 5 phases in our pentest.

We will walk through the results hand in hand with you, clarifying and explaining any findings and remediation.

1. Planning 
   • define rules of engagement and scope
2. Reconnaissance
   • Gather info on target assets to construct attack surface
3. Vulnerability Assessment
   • Automated or manual test to identify weaknesses and security loopholes
4. Exploitation
   • Align attack vectors with identified vulnerabilities to gain unauthorized access or escalate privileges
5. Reporting
   • Correlate info taken during assessment and provide remediation recommendation.
   • An interim report and a final report will be submitted. Final report is based on a re-test after vulnerabilities are remediated

Our report consists of:

1. Executive Summary
   • Overview of assessment
   • Findings categorized by OWASP Top 10
   • Final observation
2. Risk Register
   • Findings tracker
3. Engagement scope
   • Scope of work, methodology and risk model used
4. Detailed Findings
   • Issue details and background
   • Issue remediation