Penetration testing: find the flaws before someone else does
Find the flaws before those who are looking for them.
A penetration test, or pentest, attacks your systems within an authorised framework to uncover vulnerabilities that can actually be exploited. It complements automated scanners: where a tool flags a theoretical weakness, the test shows what an attacker could do with it.
The scope is defined and approved in writing before any action: web applications, APIs, the internet-facing network and the internal network. Scenarios reflect realistic threats to your business, with or without prior knowledge of the system depending on the objective.
Some regulatory or contractual contexts require a provider qualified as PASSI (ANSSI-qualified audit providers). This is checked at scoping, before any commitment, so that the report meets the use you intend for it.
What you get
- Signed test agreement: scope, testing windows, emergency contacts
- Detailed report: vulnerabilities, proof of exploitation, severity, remediation recommendations
- Summary for management, free of jargon
- Technical debrief with the teams in charge of fixes
- Retest after remediation and verification report
How it runs
Scoping and authorisation
Definition of targets, type of test and rules of engagement. Nothing starts without written authorisation covering the exact scope.
Reconnaissance and testing
Identification of exposed surfaces, then controlled exploitation attempts. A critical flaw found during testing is reported to you without waiting for the final report.
Report and debrief
Each vulnerability is documented with its evidence, its impact and a concrete fix. The debrief prioritises fixes with your teams.
Retest
Once fixes are applied, the flaws are retested to confirm they are closed.
Frequently asked
Can a penetration test interrupt our services?
The risk is controlled by the rules of engagement: testing windows, excluded techniques, emergency contacts. Tests that could degrade a service are either excluded or run in a pre-production environment.
What is the difference from a vulnerability scan?
A scan lists known weaknesses automatically. A penetration test verifies them manually, chains them together and measures real impact. The two are complementary.
How often should we run one?
After each major change to the application or infrastructure, and at regular intervals for the rest. The right pace depends on your exposure and your customers' requirements.
Further reading
- Metabase, CVE-2026-72898 and ANSSI: what a patch deployed too late reveals about your analytics tools8 October 2026
- ENISA Threat Landscape 2026: 60% of intrusions through vulnerability exploitation, and what your dependencies reveal26 September 2026
- NIS2: what the external attack surface of 21,700 French entities reveals24 September 2026
In the same practice area : Security
- Posture assessment
Where you stand, and what is missing.
- Compliance programme
Measures deployed, documented, provable.
- Fractional CISO
Accountability sits with management. We carry the file with them.
- Security tooling integration
A tool installed is not a tool in service.
- Preparation for ISO/IEC 27001 certification
From gap analysis to the certification audit.
- Awareness training and phishing simulations
The first attack vector is still people. They can be trained.
- Incident response retainer
When an incident happens, you know who to call.
Let us talk about your context.
Thirty minutes to qualify the need. The written scope follows within fourteen working days.
Request a call