Rapid Assessment
A fixed-price, five-day internal network assessment focused on the quick wins and heavy hitters (the handful of issues that give real attackers their first foothold) at a fraction of what the larger firms charge for the same depth.
Service 02
Penetration testing
A scanner tells you which versions are old. A penetration test tells you what someone can actually do to your business. We run manual, objective-driven engagements that chain real findings into real impact, then show your team exactly how to close them.
Overview
The problem we are solving
Every engagement starts with a question worth answering. Can an unauthenticated user reach customer data? Can a compromised low-privilege account reach production? Can a single exposed service become domain-wide access? Those objectives shape the testing, and the report answers them in plain language.
Automated tooling has a place, and it establishes coverage quickly, but findings that matter come from manual work: reading application logic, abusing business workflows, and understanding why a given control was put there and where it stops holding.
Testing follows established public methodology so results are defensible to customers and auditors: PTES, the OWASP Web Security Testing Guide, OWASP ASVS, MITRE ATT&CK, and NIST SP 800-115.
Coverage
Engagement types
Scope is agreed up front; these are the areas an engagement typically covers.
- Web application testing
- Authentication and session handling, access control and tenancy, business logic abuse, injection, and the full OWASP Web Security Testing Guide coverage set.
- API testing
- REST, GraphQL, and gRPC surfaces: object-level and function-level authorization, mass assignment, rate and resource abuse, and trust assumptions between services.
- Internal network testing
- Assumed-breach testing from a foothold: lateral movement, credential harvesting, Kerberos and ACL abuse, and realistic paths to domain or data compromise.
- External network testing
- Attack-surface discovery across your perimeter, exposed service exploitation, credential attacks, and the forgotten host that nobody has owned since a migration.
- Wireless testing
- Wi-Fi authentication and encryption weaknesses, rogue access point and evil-twin exposure, client isolation bypass, and guest-network segmentation.
- Physical security assessment
- Badge and lock bypass, tailgating, unauthorized facility access, and what an intruder can reach once inside: network jacks, unlocked workstations, exposed documents.
- Social engineering
- Authorized phishing, vishing, and pretext campaigns measuring detection and response, run with agreed rules of engagement and scoped to protect your people.
Methodology
How the engagement runs
-
01
Scoping & rules of engagement
Objectives, targets, testing windows, escalation contacts, and out-of-scope systems are agreed and documented before any traffic is sent.
-
02
Reconnaissance & enumeration
Mapping real attack surface (hosts, services, applications, identities, and the relationships between them), including the assets that never made it onto the inventory.
-
03
Vulnerability identification
Automated coverage combined with manual analysis of application logic, authorization models, and configuration, with every candidate finding verified by hand.
-
04
Exploitation & post-exploitation
Confirmed exploitation to establish genuine impact, then controlled lateral movement and privilege escalation to answer the objectives set during scoping.
-
05
Reporting
A report your engineers can act on and your executives can read: ranked findings, attack narratives, evidence, and remediation guidance that names the fix rather than the category.
-
06
Debrief & validation handoff
A live walkthrough with the teams who own the fixes, with validation steps for every finding so your team can confirm remediation and close the loop on its own.
Deliverables
What you receive
- Full technical report with ranked findings, evidence, and reproduction steps
- Executive summary with overall risk posture and recommended priorities
- Attack narrative documenting the paths taken from entry point to impact
- Remediation guidance specific to your stack and configuration
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with engineering and leadership
Aligned to
- Penetration Testing Execution Standard (PTES)
- OWASP Web Security Testing Guide
- OWASP Application Security Verification Standard
- MITRE ATT&CK
- NIST SP 800-115
Questions
Frequently asked
We need a pentest report for SOC 2. Does this satisfy that?
Yes. The report is structured to serve as evidence for SOC 2, ISO 27001, HIPAA, and customer security reviews, and each finding includes validation steps your team can run and document to show an auditor remediation actually happened.
Black box, grey box, or white box?
Grey box gives the best return for most clients: enough access to cover the application properly, without burning days of your budget rediscovering what you could have simply told us. We will recommend an approach during scoping.
Who actually performs the testing?
Ryan Zagrodnik performs the testing. You are not handing the work to a junior consultant after talking to a principal during the sales call.
How far in advance do we need to book?
Typically two to four weeks, depending on scope and time of year. Urgent engagements driven by a customer deadline or an incident can sometimes be accommodated sooner. Just ask.
Related
Often scoped together
AI-Assisted Penetration Testing
Agentic AI accelerates reconnaissance, enumeration, and evidence correlation across an engagement, run through isolated infrastructure: Amazon Bedrock in a dedicated environment, or a private model on in-house bare metal when nothing can leave the building.
Get started
Ready to scope penetration testing?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 ryan.zagrodnik@infocus-security.com