See how an attacker would get in, then close the door.
Controlled, authorized attacks on your network, applications and cloud, led by a certified ethical hacker, with a clear report for management and a step-by-step fix plan for your IT team.
- Certified ethical hacking
- PTES · OWASP · NIST SP 800-115
- Executive & technical reports
- Retest included
A scan lists possible weaknesses. A penetration test proves which ones matter.
Automated scanners produce long lists of potential issues, many of them false alarms. They cannot tell you whether a weak password, an old VPN and a misconfigured server could be chained together to reach your client data.
A FOXMINDS penetration test does exactly that, under written authorization and agreed rules: we attack the way a real intruder would, prove the impact without disrupting operations, and show you the few fixes that break the whole attack path.
- A written scope and rules of engagement before any testing
- Real attack paths, not just a list of scanner findings
- An executive summary management can act on
- A technical report with evidence and CVSS severity
- A 30/60/90-day remediation plan
- A retest of critical and high findings once they are fixed, included in the price
What we test
External perimeter
Public IP addresses, firewalls, VPN gateways, exposed services and email security (SPF, DKIM, DMARC).
Web applications & APIs
Client portals, websites and REST APIs tested against the OWASP Web Security Testing Guide, including access control and business logic.
Internal network & Active Directory
What a compromised laptop could reach: lateral movement, privilege escalation and paths to domain admin.
Microsoft 365 & Entra ID
MFA coverage, Conditional Access, admin roles, external sharing, mailbox rules and legacy authentication.
Wi-Fi & branches
Guest and corporate separation, rogue access points and branch-to-head-office paths.
Phishing simulation
Optional, approved by management and HR: a realistic campaign to measure and improve staff awareness.
Vendor-neutral, certified expertise
We recommend what fits your environment and budget, not what fills a quota.
- Nmap
- Tenable Nessus
- Burp Suite Professional
- Metasploit
- BloodHound
- OWASP ZAP
- Microsoft 365 configuration analysers
Certified engineers, proven in the field
Our team holds professional certifications in ethical hacking, enterprise security and next-generation firewalls, backed by more than 16 years of hands-on deployments.
- Ethical hackingCertified ethical hacker: offensive security & penetration testing
- Enterprise security & messagingCertified: server, identity and email security
- Next-generation firewallsProfessional-level firewall certification
- Firewall platformsHands-on vendor training since 2008
Frequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated and lists potential weaknesses. A penetration test adds expert manual work to confirm which weaknesses are real, chain them the way an attacker would, and prove their business impact.
Will testing disrupt our operations?
It shouldn’t. We test within agreed windows, avoid denial-of-service and data changes, and coordinate any risky step with your IT team first. A stop procedure and emergency contacts are agreed in advance.
How long does a penetration test take?
A typical engagement for a mid-sized company takes three to four weeks end to end, including planning, testing, reporting and the debrief. Smaller scopes, such as a single web application, can take one to two weeks.
How often should we test?
At least once a year and after any major change, such as a new application, a cloud migration or a network redesign. Regulated organizations often test more frequently.
What do we receive at the end?
An executive summary, a technical report with evidence and CVSS ratings, a 30/60/90-day remediation roadmap, a debrief workshop, and a retest with a letter of attestation once critical and high findings are fixed. See a full example.
Is it legal?
Yes, when it is authorized. We only test with a signed authorization from an officer who owns the systems, listing every address and application in scope, and with permission from any hosting or cloud provider involved.
Find out what an attacker would find
Tell us what you want tested. We propose a scope, timeline and fixed price, and agree the rules of engagement before any testing starts.