Process
How an assessment works
The assessment process follows a structured approach from initial scoping through final reporting and follow-up. Testing combines guided automated checks with hands-on validation. Critical or blocking findings are communicated immediately upon identification. All activities are performed in a controlled, non-destructive manner and preferably in a non-production environment.
After testing, findings are documented with evidence, reproduction steps, and practical remediation guidance. A findings meeting can be scheduled to align on priorities and next actions. Retesting can be performed once fixes are implemented.
Scope & Intake
A focused start.
Together we define objectives, scope and risk appetite, ensuring the assessment aligns with your organisation, threat landscape and decision-making needs.
Planning & Preparation
Control before execution.
Clear planning, communication agreements and defined responsibilities create predictability and confidence before testing begins.
Assessment & Validation
Realistic. Controlled. Senior-led.
Our ethical hackers operate within agreed methodologies. Critical findings are communicated immediately. All activities remain controlled and non-destructive.
Reporting & Quality Assurance
Insight you can act on.
Findings are internally validated and translated into clear reporting for both technical teams and executive leadership.
Findings Meeting & Retest
From findings to control.
We align on risks, priorities and next steps. Retesting confirms whether mitigations have been implemented effectively.
What does this mean for the board?
Scope and compliance framework are fixed in one focused session, with your risk appetite recorded in writing. Board involvement stays minimal: one approver signs off the assessment boundary and the objectives. From this point forward you have a direct line to the ethical hacker who will run the work, with no account manager sitting in between.
What does this mean for IT / Security?
Targets, APIs, environments and required access are agreed in detail, along with test accounts, source code availability and any credentials needed. The test posture (white, grey or black box) is decided against the maturity of the target, and focus areas such as authentication, authorisation and sensitive data flows are captured before any work begins.
What does this mean for the board?
Planning gives you predictability. Test windows are agreed around your release calendar, testing remains non-destructive and runs in a non-production environment wherever possible, and business continuity is protected throughout. Escalation paths are defined in advance so the right person is reached the moment something critical needs a decision, not hours later.
What does this mean for IT / Security?
The methodology is confirmed against OWASP, PTES and NIST, communication channels are set, and the split of responsibilities between your team and ours is documented. The Pentrox Portal is prepared as the working surface for the project, with intake checklists and secure document exchange replacing emailed credentials, scope documents and spreadsheets.
What does this mean for the board?
Testing is senior-led, controlled and non-destructive. Critical findings are escalated the moment they are identified, through the channel agreed in planning, rather than held back for the final report. You are never waiting weeks to learn about something that needs action today.
What does this mean for IT / Security?
Tailored automated scanning, manual validation and hands-on exploitation are combined within the agreed methodology, all performed non-destructively. Every assessment is led or supervised by senior testers holding one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP, with PES background screening across all employees. Findings appear in the Pentrox Portal as they are published, so your team can begin triage without waiting for delivery.
What does this mean for the board?
The final report is delivered within five business days of testing completing. You receive a dual register: an executive summary for decision makers and a detailed technical report for your delivery teams. Findings are ranked by business impact, not only by their severity score, so remediation priorities reflect what actually matters to the organisation.
What does this mean for IT / Security?
Each finding is documented with description, affected component, evidence, reproduction steps, severity rating (OWASP risk rating, or CVSS in compliance assessments) and remediation guidance. Every report passes an internal quality review gate before release. Four report types are available through the Pentrox Portal report library: initial report, management report, retest report and retest management report, all downloadable on demand.
What does this mean for the board?
A retest is part of every assessment at no additional cost. A findings meeting can be scheduled to walk through priorities and remediation approach with your team. Once fixes are verified, a retest management report closes the audit loop and gives you documented evidence that the identified risks have been addressed.
What does this mean for IT / Security?
The multi-cycle retest workflow is managed inside the Pentrox Portal. Your team flags findings when fixes are deployed, uploads evidence files, and receives per-finding status updates: resolved, partially resolved, still open, accepted risk or false positive. An assigned retest pentester and reviewer verify each fix, and further cycles can be requested until every finding is addressed.
Assessment Activities
Insight beyond vulnerability lists.
Our assessments combine analysis, validation and realistic attack simulation to identify, substantiate and prioritise risk.
Risk Analysis
Understanding what truly matters.
We analyse the target architecture to identify critical assets, dependencies and realistic business impact scenarios.
Automated Scanning
Scalable coverage, reduced noise.
Tailored automated testing identifies known vulnerabilities while actively minimising false positives.
Manual Validation
Certainty over exploitability.
Identified issues are manually verified to confirm whether they can be exploited in practice.
Hands-on Testing
Evidence instead of assumptions.
Our ethical hackers simulate realistic attack paths to demonstrate impact, escalation and chained attack scenarios.
Reporting
Insight you can act on.
Reports combine technical findings with risk context and clear remediation guidance for both technical teams and executive leadership.
Reporting & Deliverables
Insight that enables confident decisions.
Every security assessment results in a clear, board-ready report. Not raw vulnerability lists, but structured insight that supports prioritisation, decision-making and improvement.
All reports are delivered in English and designed for both executive leadership and technical teams.
What this report delivers
- Clear visibility of risk and priorities
- Insight into business impact
- Actionable remediation guidance
- A solid foundation for governance and audits
Executive Summary
Decision-making at a glance.
Summarises the objective, scope and approach of the assessment. Findings are grouped by severity and business impact, with clear remediation priorities. Written for both executives and management.
Vulnerability Overview
Where risk concentrates.
An overview of identified findings, categorised by type and severity. Supports prioritisation and remediation planning. Status indicators (open, fixed, retested) may be included.
Technical Conclusion
From findings to structural improvement.
Evaluates overall security posture based on severity, patterns and underlying control gaps. Recommendations focus on increasing security maturity beyond individual fixes.
Assessment Strategy & Scope
Context for correct interpretation.
Defines goals, assessed environments, test approach (e.g. white-box) and scope boundaries. Ensures findings are interpreted within the correct context.
Detailed Findings
Technical depth, practically applicable.
Each vulnerability is documented with evidence, reproducible steps and clear risk explanation (likelihood and impact), including practical remediation guidance and retesting support.
- Description and affected component
- Evidence and reproduction steps
- Severity rating (OWASP risk rating; CVSS in compliance assessments) and impact context
- Mitigation and remediation guidance
What a Pentrox report looks like
Structured for both technical teams and executive leadership.
For executives
For technical teams
From our Sample Report