How we test, what we keep finding and what a test costs; written between assessments by the people who run them.
Choosing a penetration testing provider is not only a matter of the name. The cover of the report does not tell you whether a senior specialist or a first-year tester did the work. This post sets out seven questions that make clear, before you sign, who you are hiring and how experienced they are.
Read more
At least once a year and after every major change is the short answer. The real interval follows how fast your environment changes and how much depends on it. This post sets out what ISO 27001, PCI DSS, DigiD, NIS2 and DORA require, which changes call for a test now rather than next year, and a practical cadence per situation.
A web application penetration test bought in the Netherlands has two jobs: prove which vulnerabilities the application has, and produce evidence in the form Dutch law, Dutch norms and Dutch auditors ask for. This post covers what the test examines, which frameworks drive it here, what it costs and how long it takes, what the report must contain, and what to check about the provider.
When an injection is blind and the target is rate limited, inference alone crawls to a halt. This is a field note on the technique that gets past both: forcing the database to leak its own data over DNS, one 63-character label at a time.
Do your security measures also work in practice? Read how a penetration test helps with NIS2 and which steps you can take to address risks where it matters.
A mobile app is a client you hand to the user and a set of API calls you cannot see. Testing it well takes two views: static analysis of the app itself and dynamic testing of it while it runs. This post covers what each reveals.
The cloud did not invent new classes of mistake; it made a handful of old ones faster to make and easier to miss. This post covers the misconfigurations that turn up in almost every cloud review, and the fix for each, across AWS, Azure, and GCP.
Wireless has changed. WPA3, Wi-Fi 6E, and the 6 GHz band moved the goalposts, but the findings that matter are still about downgrade, client trust, and segmentation. This post covers what a wireless assessment looks at now.
The OWASP Top 10 maps where web and API risk lives, but a list of categories is not the same as what turns up in a real test. This post covers the ones that appear most often, with a plain example and the fix.
APIs fail differently from web pages. The most common serious findings are about authorisation on individual objects, not the classic injection flaws. This post covers what an API test actually looks for.
What does a penetration test cost and what do you get for it? See our indicative prices and read how Pentrox helps you understand risks, improve where it matters and build on with confidence.
Artificial intelligence has changed how quickly parts of a penetration test can be done; it has not changed the part that decides whether an assessment is any good, which is human judgment. This post explains where AI helps, where a senior tester is irreplaceable, and how Pentrox combines the two.
A finding is closed when it has been retested, not when a fix has been deployed. This post explains what a retest checks, the three outcomes it can record, and why the record of verified fixes matters during an audit.
Schedule a free intake call to scope your assessment. Pentrox identifies vulnerabilities in your applications, infrastructure, and cloud environments before attackers do.
Schedule an intake call