A penetration test (or pentest) answers a simple question: if someone really wanted to get in, how far would they get? Our team thinks like an attacker and uses real techniques, within strict boundaries you approve in writing.
Unlike an automated tool, we exploit weaknesses manually, chain them together and measure their concrete impact: access to the CEO's mailbox, client files, the accounting system. You finally know what is serious and what can wait.
Three types of tests, depending on your needs
External penetration test
We attack from the internet, just as anyone in the world could: your website, portals, email, remote access (VPN, Remote Desktop), firewall and forgotten services. This is the first surface an attacker explores.
Internal penetration test
We start from a compromised workstation or a network jack in your office, the scenario where an employee clicked the wrong link. We then assess what an attacker could reach next: Active Directory, file servers, backups, privileged accounts. Testing is done on site anywhere in Quebec, or remotely through secure access set up with your IT team.
Not sure which one you need? Our article on external vs. internal penetration tests will help you decide.
Web application test
For your client portal, online store or line-of-business application. We follow OWASP methodology (the Top 10 and the Web Security Testing Guide): access control, authentication, session management, injection and business logic. Testing uses dedicated test accounts, ideally in a staging environment. For more detail, read our article on web application pentesting and the OWASP Top 10.
Clear rules before the first test
No testing without written authorization
In Canada, using a computer without authorization is an offence under the Criminal Code (s. 342.1). We never begin without an authorization signed by someone with the authority to grant it. If your systems are hosted by a third party, their consent may also be required.
Before we start, we draft the rules of engagement with you. This document sets out:
- the domains, IP addresses and applications in scope, and those excluded;
- the testing dates and time windows;
- permitted and prohibited techniques (for example, no denial of service);
- emergency contacts on both sides;
- how we protect any data we come across during the engagement.
Scope and price are locked in a quote before any work begins. No surprise overruns.
A prioritized, readable report
The report speaks to two audiences. Leadership gets a plain-language executive summary: the risk level, the attack scenarios we demonstrated and the priorities. The technical team gets, for each vulnerability, a description, a severity rating, the evidence (screenshots, requests), steps to reproduce it and the recommended fix.
Once your fixes are in place, we retest to confirm the gaps are closed, and you receive an attestation letter to share with clients or your insurer. To get the most out of the document, see our guide on how to read a penetration test report.
Not ready for a pentest yet? A cybersecurity audit is often the better first step: it lets you fix the obvious issues before paying someone to find them.