Penetration testing
Controlled, authorised penetration tests on your website, your applications or your infrastructure.
- 2 to 3 weeks depending on scope
- Signed authorisation
- Report for management and technical report
- Remote, anywhere in Spain
We carry out penetration testing in Móstoles and remotely anywhere in Spain: controlled, authorised penetration tests on your website, your applications or your infrastructure, external or internal.
The aim is to find the flaws before an attacker does.
Read more Read less
Each finding is delivered with its evidence, its severity and how to fix it. You receive an executive report for management and a technical report for your team. No penetration test (pentest) can guarantee that there will never be an incident, but it does show you which flaws exist in what was tested and which are the most serious.
Request a quote
To talk about penetration testing, call or write to us and we'll tell you the next steps.
How we help you
- Testing a new website or application before you launch it.
- Having a recent pentest report that a client or an insurer is asking you for.
- Knowing where everything stands after changing IT provider.
- Checking how far someone already inside your network could get.
- Knowing the severity of each flaw, with the evidence that proves it.
- Giving your team a specific recommendation to fix each flaw.
What a pentest is and what you receive
A pentest is a penetration test. We carry it out on your website, your applications or your infrastructure, always in a controlled way and with your authorisation.
It serves to find the flaws before an attacker does.
It goes beyond an automated list of alerts. In a pentest, a person checks by hand which flaws can really be exploited.
Read more Read less
What you receive is a result you can use. Each finding comes with its evidence, its severity and how to fix it. That way management knows what matters most and whoever looks after the systems knows what they need to do.
Which companies it makes sense for
It is designed for companies with a website, an online shop or an application of their own.
If your business depends on them, it is worth knowing what flaws they have and how serious they are.
Read more Read less
It is also for companies that are asked for a pentest by a client, an insurer or an audit. In that case, before commissioning it, ask what scope they require and what kind of report they expect. With that information it is easier to define the test properly.
If you are not sure whether it is what you need, call us and we will look at it with you.
Why it is usually commissioned
There is almost always a specific reason behind a pentest. These are the most common:
- You are about to launch a new website or application and want to test it first.
- A client or an insurer is asking you for a recent pentest report.
- You have changed IT provider and want to know where everything stands.
- You want to check how far someone already inside your network could get.
Read more Read less
Each reason changes what is worth testing. With a new website, the test focuses on that website. If you want to know what someone already inside could do, an internal test is needed. That is why the first step is to tell us what led you to consider it.
How we work, step by step
We do not start testing anything until the scope has been agreed and the authorisation has been signed. The process always follows this order:
How we get started
- We meet to define what is tested, when and within what limits.
- We sign the authorisation and the testing window.
- We carry out the tests on the agreed dates, with a contact person on your side available and an immediate warning if a critical flaw comes up.
- We deliver the reports and walk you through them in a meeting.
- We check the fixes for the serious flaws.
- Meeting to define what is tested, when and within what limits.
- Signing of the authorisation and the testing window.
- Tests on the agreed dates, with a contact person on your side available.
- Immediate warning if a critical flaw comes up during the tests.
- Delivery of the reports and a presentation meeting.
- Checking of the fixes.
What the service includes
The work covers everything from the initial meeting to re-checking the serious flaws. This is what is included:
To test websites and applications we use public methodologies such as OWASP's. It is an open reference on how to carry out these tests, not an accreditation.
We mention it so you know the criteria we work to.
- Scoping meeting and signed authorisation document.
- Website and application testing.
- External infrastructure testing, internal infrastructure testing or both, as agreed.
- Classification of each finding by severity, with the evidence that proves it.
- A specific fix recommendation for each flaw.
- Executive report for management and technical report for your team.
- A re-check of the serious flaws once they have been fixed.
How it is quoted and how long it takes
The price depends on what is included in the test. A small scope is, for example, a website or an application.
The price is fixed in writing before we start, and the prices we give do not include VAT (21%).
A pentest takes 2 to 3 weeks depending on the scope. The specific test dates are set at the initial meeting.
So that we can advise you better, have to hand which websites, applications or systems you want to test, whether the test is external, internal or both, and whether you have a deadline.
If a client or an insurer has asked you for the report, also tell us exactly what they asked for.
2 to 3 weeks depending on scope
What is not included
- Fixing the flaws, which is done by your team or quoted separately.
- Social engineering tests on staff, which belong to the security awareness service.
- Denial-of-service tests that could bring down systems in production.
Read more Read less
It is worth knowing this before commissioning it, because it is what people most often take for granted. A pentest finds and explains the flaws, but it does not fix them.
Nor do we carry out denial-of-service tests that could bring down systems in production. This limit is part of how we work.
How often to repeat it
The usual practice is to repeat the pentest once a year and after every major change.
A report describes the state of what was tested on those dates. Systems change: a new application goes live, you change provider or the infrastructure is modified.
When that happens, part of what was reviewed is no longer up to date.
Read more Read less
That is why it is worth putting the next review in the calendar and discussing with your team which changes are planned.
Who you talk to
Aitor handles management and client relations. You can talk to him about what you need to test and how it fits into your company.
Before signing with any penetration testing provider, it is reasonable to ask who will carry out the tests and what experience they have with systems like yours.
It is a normal question and worth asking.
Where we work
We work remotely anywhere in Spain and in person in the Comunidad de Madrid. Our base is in Móstoles.
Wherever your company is, you can start the conversation: the scoping meeting is where we agree what is done remotely and what, if needed and you are in the Comunidad de Madrid, is done in person.
What people most often ask before starting
The questions tend to be the same: how long it takes, whether it will affect day-to-day work, what access is needed and how the price is set.
A pentest takes between 2 and 3 weeks from when the scope is signed, and the price is fixed in writing before we start.
Read more Read less
The tests are planned so as not to interrupt work. People also often ask how it differs from a vulnerability scan: that scan is an automated review, whereas in a pentest a person checks by hand what can be exploited. As for frequency, the usual practice is to repeat it once a year and after every major change.
Questions about penetration testing
How long does a penetration test (pentest) take?
Between 2 and 3 weeks from when the scope is signed, depending on the number of applications and systems included in the test.
Can it affect how the company runs?
The tests are planned so as not to interrupt work. We agree dates, times and limits. Anything that could affect production is tested in another environment or left out.
What is the difference between a pentest and a vulnerability scan?
A vulnerability scan is an automated review that lists possible flaws. In a pentest, a person checks by hand which ones can really be exploited and how far an attacker could get.
How much does it cost?
It depends on what is included in the test. A small scope, such as a website or an application, is not the same as several systems. The price is fixed in writing before we start. Call us, tell us what you want to test and we will tell you how to proceed.
Do you need access to our systems?
It depends on the test. The external test is done from the internet, as an attacker would do it. The internal test is done connected to your network, remotely or in person. For applications, we can test with test users that you give us.
How often should it be repeated?
The usual practice is to repeat the pentest once a year and after every major change.
Is fixing the flaws part of the pentest?
No. The fixes are made by your team or quoted separately. We give you a specific recommendation for each flaw and re-check the serious ones once they have been fixed.
Are staff tested as well?
No. Social engineering tests on staff are not part of penetration testing. They belong to the security awareness service.
Exposure assessment
We review from the outside what an attacker can see of your company and give you a report for management and a prioritised plan.
Security awareness and phishing simulation
Practical training for your staff and simulated phishing emails, with aggregated results for management.
24/7 monitoring and response
Managed SOC for SMEs: we monitor computers and servers around the clock, analyse the alerts and, if an attack is real, we contain it and let you know.
NIS2, ENS and ISO 27001 compliance
We prepare your company for NIS2, ENS or ISO/IEC 27001 and support you through the audit.
Tell us what you want to test
Call us on +34699240879 or email us at hola@oteosecurity.com. Tell us which website, application or systems you want to test and whether anyone has asked you for the report.
With that, we will work out the next step and tell you how to proceed.