Penetration Testing

The duration depends on scope: a web application test takes 3-5 days, while a full network test requires 1-2 weeks. We'll discuss the exact timeline during the intake meeting.

We test within agreed windows and with techniques that will not take your systems down. Anything that carries a risk of disruption is discussed upfront and only carried out once you approve it. For critical systems we test with extra caution.

We follow the Penetration Testing Execution Standard (PTES) and OWASP guidelines. Our pentesters are OSCP and CEH-certified.

We treat it strictly confidential. We only document what's necessary for the report and delete all data afterwards. This is covered in our NDA.

Yes. Automated tools and AI pentesting tools cover breadth and frequency well. Ethical hackers add depth, context, attack chains and signed reports, and also test people and processes. Most mature security programs combine both.

AI speeds up reconnaissance and is improving quickly. An ethical hacker adds depth, context and attack chains, also tests people and processes, and stands behind the report. At Sectricity every finding is validated manually. Many teams combine an AI tool for regular coverage with a pentest for depth.

Professional external pentests usually start around €2,500 for a limited scope, always including the retest. Authenticated testing, multiple user roles, APIs and payment flows increase the scope and therefore the price; complex enterprise environments can exceed €20,000. We always establish the exact price in a free scoping call before we quote. Our pentest cost guide explains the factors and the questions to ask any provider.

At least annually, plus after significant changes such as new applications, migrations, or acquisitions. Frameworks like ISO 27001 and NIS2 expect demonstrable testing of your security measures, and cyber insurers increasingly require evidence. Fast-changing environments benefit from on-demand testing through RedSOC.

A vulnerability scan automatically detects known issues. A pentest is human-led: our ethical hackers actively exploit vulnerabilities, chain them into realistic attack paths, and manually validate every finding. Mature programmes use both.

Yes. Every Sectricity pentest includes the retest: one retest per finding, with written confirmation per finding of open or closed. Verifying that fixes actually work is part of delivering real security, and it gives your auditors and insurers the evidence they need.

Yes. Apps built with tools such as Lovable, Bolt or Replit often reach production with open database rules, exposed keys and weak access control. Our Go-Live Pentest is a web application pentest for exactly these apps, done before launch, with a clear go or no-go and the retest included.