Automated assessments
Every week, we assess the systems and environments defined in the scope. A specialist reviews the results, and you receive evidence, priorities and guidance to fix the issues.
Define the scope
Your offensive security team, working with you continuously.
Pentesty brings together specialists and proprietary technology in an offensive security program tailored to your product and your business. We combine pentests, Red Team, automated assessments and other services from our portfolio according to your risks and goals, following product changes and the progress of fixes.
Let's build your security programYour product defines the scope.
Every engagement starts with your context: your product, your risks and your priorities. From there, we build a tailored scope and focus testing on what could compromise your operation, your data and your customers' trust.
Pentest
WebApplications, authentication, permissions and business logic. We assess the flows that support your operation.
APIAuthorization, data exposure, integrations and isolation between users and organizations.
MobileAndroid and iOS apps, local storage, communication and integrations in scope.
InfrastructureInternal and external networks, services, identities and connected devices, including cameras and turnstiles. We assess the security of the network assets defined in scope.
CloudCloud accounts and projects, permissions, exposed resources and trust relationships between services.
Red Team
- Continuous Red TeamOur team runs recurring attack simulations, reviews objectives with your team and verifies fixes between exercises.
- Adversary emulationScenarios based on relevant threats to assess how your defenses respond to the techniques planned for the exercise.
- Social engineeringSimulations to assess how your team recognizes and reacts to manipulation and fraud attempts, following agreed scenarios and limits.
- Physical intrusionPhysical access tests integrated into Red Team scenarios, with locations, objectives and limits agreed with your team.
- Phishing campaignsAgreed simulations to measure the recognition and reporting of fraud attempts and guide improvements in people, processes and controls.
How we work
01
Context and priorities
We learn about your product, the risks to your business and your goals. Together, we select the services and define the scope, access, limits and cadence of the program.
02
Testing with specialists and proprietary technology
We run the tests and exercises defined in the scope. Our proprietary technology supports the investigation, and our specialists verify the evidence and assess the impact on your business.
03
Findings and remediation guidance
We present the findings and prioritize fixes by impact. Your team receives evidence and guidance to implement the changes, including a remediation prompt for each finding.
04
Retests and next cycle
We verify the fixes in the agreed retests and record how the findings evolve. We review priorities with your team to plan the next cycle and account for product changes.
Let's build your security program
The combination of services, the cadence and the depth of testing are defined in the program scope and reviewed with your team as risks and priorities change.
Clarity to decide. Evidence to fix.
You receive evidence validated by specialists and fix priorities tied to the impact on your business, with depth and format defined for your program or project.
Learn about our methodologyExecutive summarySample platform
Three priorities for this round
The risks below affect customer data and contract negotiations. The first item should be fixed before the next release.
- Data export without access controlRisk of customer data exposureHigh
- Sessions remain valid after a password changeRisk of account takeoverMedium
- Broad permissions on a service accountIncreases the impact of any unauthorized accessMedium
Technical reportSample finding · CVSS 8.6
Data export accessible across organizations
An authenticated user can export records from another organization by changing the identifier in the request.
GET /api/v2/orgs/4817/export HTTP/2 Authorization: Bearer <token from organization 2093> HTTP/2 200 records from another organization
Recommendation: validate on the server that the user belongs to the requested organization before generating the export.
Coverage and limitationsSample platform
What was assessed and under what conditions
- Web application and authenticationTested with two access profilesAssessed
- Public API v2Staging environmentAssessed
- Payment webhooksNo partner credentials during the test windowInconclusive
- Android appOut of scope for this roundNot included
Fix validationSample retest
What changed since the last round
- Cross-organization data exportRequest now returns 403Fixed
- Sessions after a password changeMobile sessions still remain activeNeeds attention
- Service account permissionsPermissions reduced to what is neededFixed
Fix promptSample finding
Ready for your team or AI tool
Context: the GET /api/v2/orgs/:id/export route does not check whether the user belongs to the requested organization. Task: add the check on the server, before generating the export, and return 403 when the user is not a member. How to validate: repeat the request with a token from another organization and confirm the 403. Then confirm that legitimate members can still export normally.
Your team reviews and applies the change. The retest confirms the result under the contracted conditions.
Illustrative content. Depth and format are defined for your program or project.
Frequently asked questions
Still have questions? Reach us at support@pentesty.co
What services does Pentesty offer?
We offer Web, API, Mobile, Infrastructure and Cloud pentests, automated assessments and Red Team exercises, including adversary emulation, social engineering and phishing. We combine the services in a recurring program or a one-off project, according to the agreed scope.
What is the difference between Pentest and Red Team?
A Pentest investigates vulnerabilities within a defined scope. A Red Team simulates an attacker's actions to assess how your teams and controls respond. In the continuous program, we review objectives with your team, run agreed campaigns and follow up on fixes. Exercises may combine adversary emulation, social engineering, phishing and physical intrusion.
How does Pentesty use proprietary technology?
Our proprietary technology supports the specialists in investigating vulnerabilities and deepening their analysis. They verify the evidence, assess the impact on your product and prioritize fixes according to the risks to your business.
What do I receive at the end of the engagement?
You receive an executive summary and a technical report. Each finding includes evidence, priority and fix recommendations. Your team reviews and applies the changes. We present the results and, for Red Team, the attack paths and how your teams and controls responded to the tests.
How much does it cost and how long does it take?
Investment, timelines and frequency depend on the systems, risks, objectives and depth of the work. We define services, scope, schedule, deliverables and retest conditions in the proposal before starting.
How does the recurring program work?
We start with your business risks and objectives to define which services in our portfolio make sense at each stage. Throughout the program, we review priorities with your team, investigate vulnerabilities and validate the agreed fixes. The combination of services, the frequency of the work and the retests are defined in the proposal.
Can I book a one-off project?
Yes. If you need to assess a system, investigate a specific risk or carry out a defined exercise, we can structure a one-off project. Scope, timeline, deliverables and retest conditions are agreed in the proposal.
Is the retest included?
The retest verifies the fixes for the agreed findings. Its inclusion, timeline, number of rounds and limits are defined in the proposal. New assets or significant changes may require a new scope.
Does the report help with audits and compliance?
The evidence can support audits and compliance assessments. Acceptance depends on the requirement, the scope and the auditor's assessment. The report does not certify compliance or guarantee approval for ISO 27001, SOC 2, PCI DSS or LGPD.
How are tests authorized and conducted?
Before execution, we align on authorization, assets, permitted techniques, windows, contacts and stop conditions. Social engineering and physical activities have their own limits. The handling of evidence is agreed with the client.
Shall we build the scope for your product?
Talk to our specialists about your product, your risks and your priorities. Together, we define the work that makes sense for your business.
Build my program