01
Definition of the scope
We receive information about the systems to be checked, e-mail addresses and IP addresses from the client. On this basis, we determine all systems, sub-domains and e-mail addresses that can be assigned to the area. If certain systems or addresses are not checked, they can be removed or added again at any time.
02
Carrying out the penetration test
There is a remote overall check of the external infrastructure (web server, VPN gateways, mail server, web applications, etc.) for security gaps and possible gateways from the perspective of a potential attacker, this is done using our fully automatic scan cluster. After that, a check is also carried out to determine whether there are possibly stolen company data records in circulation on the Darknet.
03
Assessment
After the check has been completed, the vulnerabilities found are classified, summarized and evaluated based on type (according to CVSS), criticality, urgency, properties and affected systems in eleven different categories (e.g. web security, passwords). . The integrated AI gives a rating from A to F, with A being the best and F being the worst, indicating the existence of many critical security vulnerabilities. In addition, the most common security problems and the most vulnerable infrastructure systems are listed. The right conclusions can thus be drawn, which makes prioritization easier and can significantly minimize the effort.
04
Recommendations for improvements
We prepare the analysis in a comprehensible form for you and show you where there is a concrete need for action. The categorization and harmonization of the numerous data enable a quick overview and a quick understanding of the current security situation.
In addition, we give you recommendations for the measures or support you on request with the implementation.
The result is impressive: A well-founded, understandable and cost-effective assessment of the client's security situation!
How does our penetration test work
Our process at a glance
Frequently asked questions about penetration testing
How long does the penetration test take?
We are fast and flexible in terms of time, depending on the target, number of objects and size of the company, the throughput time per scan is at least 3 days (for companies with up to 250 employees), with several targets and a larger infrastructure it can be take a few days longer.
Can I use it to meet standard requirements?
Yes, the norms and standards (e.g. ISO27001, TISAX®) require the systems and infrastructure to be checked at regular intervals but does not specify exactly what to do. In the practice of exams, however, a test plan appropriate to the risk (which exam, when, which objective, etc.) is required and die nachweisliche Bearbeitung von Schwachstellen thematisiert. Grundsätzlich ist der Nachweis des aktiven Managements (reaktiv, präventiv) von (potential) weaknesses conducive to a positive test result. But this is also important in external communication with customers or the entire market, because security is an important feature today. Your customers want to be able to rely on you!
Can Opexa guarantee a short lead penetration test?
Yes, you will receive a test result no later than 4 working days after ordering! We may only need a little more time for larger infrastructures (from 250 employees).
What performance models do you offer?
The service is flexible and adapts to your needs.
You can choose a one-time or three-time scan, but we also offer a fixed subscription for 12 or 36 months WITHOUT limit in the number of scans.
The latter is particularly recommended for organizations with frequent changes in the infrastructure or with high security requirements. A subscription is advantageous due to the unlimited number of scans and, in relation to the price of the individual test, is significantly more economical! The effort and thus the price depends on the service model and the size of the company.
Due to the constantly growing attack surface of companies, the need for IT security and thus the demand for cybersecurity measures and services is increasing. The externally accessible infrastructure must be protected and further developed as best as possible, so it is essential to know the weak points in order to make appropriate implementation and investment decisions. A quick and needs-based manual check of the externally accessible infrastructure for vulnerabilities by specialists is often not possible for reasons of capacity, time and cost. This is where we start with our Penetration Test and offer a quality, fast and economical service.
