Penetration testing
We test your company's applications and infrastructure using the techniques an attacker would, within the limits of a written agreement. You receive the vulnerabilities found, their impact and recommendations for remediation.
What you receive
- Written agreement: systems, period, permitted techniques, contacts
- Authentication, authorisation, injection, configuration, application logic
- Internet-accessible services, configuration, vulnerable versions
- Identities, access, sharing and security settings
When it helps
- A new application is about to launch or has changed significantly.
- A client or a compliance requirement calls for a penetration test.
- The company wants to know what is exposed to the internet and how vulnerable it is.
- After an incident or a suspected compromise, as part of the assessment.
Activities and deliverables
Test scope and rules of engagement
Written agreement: systems, period, permitted techniques, contacts
Web application testing
Authentication, authorisation, injection, configuration, application logic
Internet-facing infrastructure testing
Internet-accessible services, configuration, vulnerable versions
Cloud and Microsoft 365 configuration review
Identities, access, sharing and security settings
Report
Management summary and technical detail with evidence and remediation
Retesting
Verification of fixes, if included in scope
What we aim for
The objectives of the engagement, not guaranteed results.
- Significant vulnerabilities identified before they are exploited.
- Fixes prioritised by severity and impact.
- Fixes confirmed by retesting, if agreed.
- A report you can present to clients or auditors.
What the result depends on
Test coverage depends on the agreed scope, the access and test accounts provided, the testing window and the stability of the environment under test. A test identifies vulnerabilities at a point in time; it does not guarantee that no others exist.
Responsibilities and limits
What UDG Group does
- Agree the scope and rules of engagement.
- Carry out the tests within the agreed window.
- Document vulnerabilities with evidence and severity.
- Present the findings and recommendations.
What stays with your company
- Authorises the test in writing and confirms its rights over the systems tested.
- Provides test accounts and a technical contact.
- Implements the fixes.
What is not included
- Systems the company has no right to authorise for testing; cloud services are tested only within the provider's testing policy.
- Tests that could affect availability, unless explicitly agreed.
- Any guarantee that the system has no other vulnerabilities.
Steps
Scope and authorisation
Systems, period, techniques and contacts, in writing.
Reconnaissance
Mapping the attack surface.
Testing
Controlled attempts to exploit vulnerabilities.
Report
Findings, severity, evidence and recommendations.
Retesting
Verification of fixes, if agreed.
What affects timing and cost
Scope, timing and cost are agreed in writing before any work starts.
- The number and complexity of applications and systems.
- The type of test: external, authenticated or with source code access.
- The length of the testing window.
- Whether retesting is included.
Frequently asked questions
What is the difference between a penetration test and a vulnerability scan?
An automated scan finds known, surface-level issues. A penetration test combines tools with manual analysis and checks whether vulnerabilities can actually be exploited and what impact they have.
Can the test affect how our systems run?
Tests are planned to reduce that risk: testing windows, permitted techniques and emergency contacts. Tests that could affect availability are carried out only with explicit agreement.
Can I use the report with clients or auditors?
Yes. The report has a management summary that is useful for clients and auditors, and a technical section for the team making the fixes.
Related services
Discuss this service
Tell us briefly about the context: your deadline, what you already have in place and the result you are aiming for.
We treat every enquiry with discretion. We can sign a mutual NDA before discussing sensitive information.
If you do not use an email app, copy the address and write to us from your own account.
We use the details in your message to reply to you. More in our privacy policy.