Evaluate · Offensive Security
What would an attacker find in your systems? Our pentesters tell you first.
Your web applications and Microsoft 365 tenant attacked the way an attacker would, every flaw delivered with its fix, then a retest included within 60 days. From €4,000 excl. VAT.
Finding 01
Critical
Remote code execution on the web application
- CVSS score
- 9.8
- Path
- Web application → Internal server → Active Directory
- Found
- Fixed
- Closed at retest
- CVEs and fixes credited to our pentesters, on real-world flaws
- 100+
- Public methodology, all 7 phases on every engagement
- PTES
- Every finding scored, with its evidence and its fix
- CVSS
The 7 PTES phases, then the fix and the retest
Seven PTES phases, from scoping to report, then two steps that close the loop: the fix, then the retest, included within 60 days of the report. Follow an attacker's path, phase by phase: each phase leaves its mark on the map, all the way to the retest.
06 · Post-exploitation
- Owl AI, our pentesters' in-house tool: probes and known vulnerabilities
- Pentesters: exploitation and chaining
- Link fixed, then verified at the retest
- Pentesters
Pre-engagement & rules
Scope, testing windows and rules of engagement agreed with your IT team, before the first test. NDA as standard, data processed in accordance with the GDPR.
- Owl AI
Intelligence gathering
Passive and active attack surface mapping: DNS, subdomains, exposed services, leaked credentials.
- Pentesters
Threat modeling
What matters to your business, and the most likely paths to reach it.
- Owl AI
Vulnerability analysis
Ports, services, versions and known CVEs. Owl AI replays known vulnerabilities and prioritizes high-impact vectors.
- Pentesters
Exploitation
Controlled exploitation attempts on the selected vectors: privilege escalation, lateral movement.
- Pentesters
Post-exploitation
Realistic simulation of a persistent attacker, up to a simulated exfiltration, to measure your detection capability.
- Pentesters
Reporting & debrief
Every link in the path becomes a finding: evidence, CVSS score, prioritized fix. Executive and technical report, presented to management.
- Your team or ours
Remediation
Two ways to close each flaw: your team applies the fix detailed in the report, or we apply it for you, as agreed during scoping. A fix in an application's code goes through your developers or your software vendor. When we apply it, an expert validates it before it goes into production.
- Pentesters
Retest
Within 60 days of the report, we retest every fixed flaw and check that it really is closed. The retest is included in the price.
What you receive
Every link in the attack path becomes a finding: its evidence, its CVSS score and its prioritized fix.
Executive report
For your management: what was reached, and what to fix first.
Technical report
For your IT team: every finding with its evidence, CVSS score, reproduction steps and fix.
Debrief
The report is presented to your management by the pentesters who ran the test.
Retest included
Within 60 days of the report, we check that the fixed flaws really are fixed.
The questions we get before signing
No. Scope, timing and scenarios are agreed with you beforehand. Exploitation stays controlled and non-destructive, with a permanent point of contact during the engagement. If you prefer, tests can be run on a pre-production or dedicated environment. We only test what was scoped: no denial of service, and no social engineering without explicit written authorisation.
At least once a year, and after any major change: new application, redesign, significant release. The retest is included: within 60 days of the report, we check that the fixed flaws are closed.
The report gives, for each flaw, the fix to apply. Your team applies it, or we apply it for you: this work is agreed during scoping. A fix in an application's code goes through your developers or your software vendor. Every fix we apply is validated by an expert.
Yes, if you wish. As a principle, we recommend that an independent provider tests an infrastructure we monitor: an outside view avoids assessing our own work. If you prefer to entrust us with both, we will do it.
Let's scope your pentest.
Request a free audit: we define the scope and set the price, from €4,000 excl. VAT per web application or Microsoft 365 tenant.
After you send it
Reply within 24 business hours
An expert reads your request and gets back to you to qualify your need.
Free audit
On Microsoft 365: a one-hour audit of your tenant's posture (Secure Score, identities, Defender) and your priority flaws. Otherwise: we scope your need (pentest, security policy) and set the price. No commitment.
Dedicated contact
The same DMC expert follows you end-to-end, with no call-center in between.