What our penetration testing services cover
Different parts of your estate fail in different ways, so we scope each one deliberately instead of pointing one generic test at everything.
External network penetration testing
Everything reachable from the internet: exposed services, forgotten subdomains, staging environments, open ports, VPN and mail infrastructure — the surface a real attacker starts from.
External penetration testingWeb application penetration testing
Authenticated and unauthenticated testing: session handling, access control between roles and tenants, input handling, file uploads, checkout flows and your own business logic. Aligned to the OWASP Top 10 and the OWASP Web Security Testing Guide.
Website and web application penetration testingAPI penetration testing
REST and GraphQL endpoints tested at the object level: broken object-level and function-level authorization, excessive data exposure, rate limiting and authentication flows.
API penetration testing guideInternal network penetration testing
What an attacker reaches after the first foothold: lateral movement, privilege escalation, Active Directory paths and segmentation gaps. Run remotely, over a VPN connection into your environment.
Cloud penetration testing
AWS, Azure and GCP configuration and identity review, plus active testing of what those misconfigurations allow — over-permissive roles, exposed storage, metadata service abuse.
Mobile application penetration testing
Both sides of the app: the compiled APK/IPA — data at rest, secrets, certificate validation, behaviour on a rooted device — and the backend API it talks to.
Mobile application penetration testing guideRed team engagement
A goal-driven adversary simulation rather than a checklist assessment: we agree an objective, work toward it across whatever paths your defenses leave open, and measure how quickly the activity is detected and answered. Scoped as a separate engagement.
Not sure which of these you need? That is what the scoping call is for, and it costs nothing.
Book a scoping call
Why a manual penetration test finds what scanners miss
Most teams reach for a scanner first, and a scanner earns its place — it covers ground quickly and catches the known, the outdated and the misconfigured. The trouble starts when a scan report becomes the security assessment.
Scanners find signatures. Testers find logic.
A vulnerability scanner compares what it sees against a database of things that have gone wrong before. It has no model of your business. It does not know that your API returns another tenant's invoice when you increment an ID, that a password reset token stays valid after use, or that a support role can escalate to admin through a settings page nobody thought to lock down. Broken access control, IDOR, authentication bypass and business logic abuse get found by a person asking "what happens if I do this instead?"
Unverified findings cost you twice.
Raw scan output sends your engineers to fix issues that cannot be reached in your configuration, while the one that can be reached waits in the backlog behind them. Manual verification inverts that: we exploit what we find, and what we cannot exploit does not get dressed up as a critical.
And someone has to sign it.
Enterprise procurement, SOC 2 auditors and security questionnaires do not accept a tool export. They want an assessment performed by a qualified third party, with a defined scope and a named provider behind it. That is what a penetration testing service is for.
That is the principle the engagement runs on — found is not the same as vulnerable, and vulnerable means exploitable. If we report it, we can show you it working.
How we run an engagement
- Step 01
Scoping and authorization
We agree what is in and out of scope, confirm you own or control the assets, and sign the rules of engagement: testing window, escalation contacts, what happens if we find something critical mid-test, and what we will not touch. Nothing starts before that is in writing.
- Step 02
Reconnaissance and attack surface mapping
We map what you expose — routinely more than the asset list says. This is where our automation earns its place: BackDoor's own engine handles the breadth, enumerating hosts, subdomains, endpoints and technologies faster than a person can, so the team spends its hours on judgment instead of inventory. The tooling gathers; the tester decides.
- Step 03
Manual testing and exploitation
The core of the engagement. Testers work through the application and infrastructure by hand: authorization boundaries between roles and tenants, authentication and session flows, injection points, file handling, and the chains that turn three medium findings into one critical. This is the part no scanner performs.
- Step 04
Proof of concept
Every reported finding is confirmed by exploiting it, with the steps documented so your team can reproduce it. If we cannot demonstrate impact, it goes in as an observation, not a vulnerability.
- Step 05
Reporting
You receive findings prioritized by risk, each with a CVSS score, business impact and concrete remediation guidance.
- Step 06
Remediation support and retest
After you ship the fixes, we verify them. A finding is not closed because a ticket was closed — it is closed because we ran the exploit again and it no longer works. Retesting is included at no extra cost for one month after the report is delivered — re-run it as you close findings, not as a separate purchase.
Testing runs in a restrained mode by default: no load-generating attacks, no destructive payloads. You set the window, and you can call a stop at any point.
Our methodology draws on the established standards — the Penetration Testing Execution Standard (PTES), the OWASP Web Security Testing Guide, NIST SP 800-115 and MITRE ATT&CK for adversary techniques — applied to what is in scope rather than as a one-size checklist. A deeper walkthrough of the phases is in our guide to penetration testing methodology.
The boundaries between your user roles
Every application with more than one kind of user has a set of invisible walls: what a viewer must not see, what a support agent must not change, what one tenant must never reach inside another. Scanners do not test walls — they test pages.
- What a scanner doessignatures
Checks pages
A signature engine visits what it can crawl and matches responses against a database. It has no model of who you are supposed to be when you send the request.
- Known CVEs
- Version banners
- Surface coverage
- What a tester doeswith your accounts
Walks through walls
A wall only breaks when someone holds two accounts and deliberately tries to walk through it carrying the wrong one. That is the work our testers do with the credentials you provide.
- Support → admin
- Another company's invoice
- Payment skipped
- UI-only authorization
Tell us your roles, give us one working account per role, and we test every boundary between them — that count, not the number of pages, drives depth and quote.
Book a scoping callWhat you get: the report
The report is the deliverable you live with. It goes to your engineers, to your board and, sooner or later, to a customer's security team. Ours comes in two layers.
Executive summary
What was tested, what the risk to the business is, and what to do first — written to be read by someone who does not work in security.
Technical detail
Each finding with its CVSS score and severity, the affected assets, reproduction steps, the proof of concept, and specific remediation guidance. Not "sanitize your inputs," but what to change and where.
A prioritized fix list
Findings ranked by exploitability and impact, so the first week of remediation goes where it matters instead of where the list happened to start.
Retest confirmation
A record of what was re-tested and what is verifiably closed — the artifact auditors and enterprise customers ask for by name.
You do not have to take our word for the format.
See a real sample reportWho actually does the testing
The most useful question you can ask any penetration testing company is who will be on your engagement. The answers vary more than most buyers expect: some vendors run a crowdsourced marketplace, some subcontract to a partner in another timezone, and some resell a scan with a cover page on it.
Our testing is done entirely in-house.
No crowdsourced marketplace, no subcontracting to a partner in another timezone. The people who scope your engagement are the people who run it.
Our team holds the certifications buyers in this market look for
— OSCP, OSWE, CREST, GPEN and CISSP — the specific credentials, not a line about "certified professionals."
- OSCP
- OSWE
- CREST
- GPEN
- CISSP
We are a young company staffed by testers who are not.
Each brings more than eight years of hands-on offensive security work, so the people on your engagement have seen the failure modes your systems are likely to have long before BackDoor existed.
You get the tester, not a ticket queue.
When a finding lands and your engineers disagree with the severity, or need to understand the exploit path before they can fix it properly, that conversation happens with the person who found it — which is usually the difference between a fix that holds and a fix that gets reopened. Every engagement ends with a debrief call with the tester who did the work, walking your team through the findings and how each was reached.
We also publish who writes and reviews our security research: see our editorial policy and the people behind it.
Manual or automated penetration testing — which do you need?
This is the question we are asked most, and the answer is usually "both, for different jobs."
| Human-led testing | Automated and continuous testing | |
|---|---|---|
| Best at | Business logic, access control between roles, attack chains, custom applications | Breadth, known vulnerabilities, changing perimeters, regression between tests |
| Speed | Days to weeks | Hours, repeatable on a schedule |
| Depth | Reaches what only a person would think to try | Bounded by what it was built to look for |
| Compliance sign-off | Accepted by auditors and enterprise reviews | Usually supporting evidence, not the assessment |
| Frequency | Point in time — per release, per year | Ongoing |
Your perimeter changes every week, and a once-a-year test knows nothing about the subdomain that went live in March. Equally, no automated system is going to reason about whether your refund flow can be abused. Run continuous coverage across the surface that keeps moving, and bring people in for depth, for new features, and for the assessment somebody has to sign.
BackDoor offers both sides: a team that tests by hand, and an autonomous AI-driven testing engine that keeps watching between engagements. We will tell you which one your situation calls for, including when the answer is the cheaper one.
For the longer version of this argument, see our guides to automated penetration testing and penetration testing as a service.
Penetration testing for SOC 2, PCI DSS, ISO 27001 and GDPR
- SOC 2Testing requirements
- PCI DSSInternal & external testing
- ISO 27001Technical assurance
- GDPRArticle 32
Most first penetration tests are triggered by a deadline rather than a breach: an auditor, a renewal, or an enterprise deal stuck in security review.
A penetration test report supports the testing requirements in SOC 2, the requirement for regular internal and external testing under PCI DSS, the technical assurance expectations of ISO 27001, and the security-of-processing obligations under GDPR (Article 32). On request, we map each finding to the relevant control so your auditor can trace it directly, instead of leaving you to rebuild that mapping by hand the week before the audit.
One honest caveat
A penetration test does not make you compliant. It produces the evidence a specific control asks for. Anyone selling you a test as a certificate is selling you something else.
How much do penetration testing services cost?
Pricing in this market is opaque enough that comparing two quotes is hard work. Here is what moves the number.
We scope from your actual asset list rather than a form, so the quote reflects the work rather than an average. A breakdown of market pricing is in our guide to penetration testing cost.
…with the final figure set by the factors above rather than a fixed price list.
- Scoping call at no cost
- Retesting included for a month
- Auditor-ready reporting
- Quote built from your asset list
How to choose a penetration testing company
Whether or not you work with us, these are the questions worth putting to every penetration testing service provider on your shortlist.
Who performs the test?
In-house team, crowdsourced researchers, or a subcontractor? Ask for the model, not a reassurance.
What methodology do they follow, and will they name it?
A provider that cannot point to PTES, the OWASP WSTG or NIST SP 800-115 is improvising.
Is it manual testing, or a scan with a cover page?
Ask how many hours are hands-on keyboard, and ask to see what a finding looks like written up.
Is a retest included?
And for how long after delivery?
Can you see a sample report before signing?
Anyone confident in their work will show you one.
Who is liable, and what protects you?
NDA, insurance, and how they handle your data during and after the engagement.
What happens when they find something critical mid-test?
There should be a documented escalation path, not an email at the end.
Deeper buyer's checklists are in our guides to penetration testing services and choosing a penetration testing company.
Penetration testing guides from our team
Everything we have published on how penetration testing works, what it costs and how to buy it — written by the testers who do the work and reviewed under our editorial policy. All guides live in the BackDoor blog.
Basics
- Types of Penetration Testing: A Complete GuideThe main types of penetration testing explained — black, white & grey box, and by target: network, web app, mobile, cloud, wireless, and social engineering.
- Who Is a Penetration Tester? Role, Skills & How AI Is Changing ItWhat a penetration tester does, the skills and certifications that matter, realistic salaries — and how AI and autonomous testing are reshaping the role.
- What Is Penetration Testing (Pen Testing)? Types, Stages & ToolsWhat penetration testing is, how it differs from vulnerability scanning, its types, stages, and methodologies — and how AI is making it continuous.
AI & Automation
- Automated Penetration Testing: What to Automate, What to Never AutomateAutomated, autonomous, agentic — what the labels mean, what today’s tools actually cover, and where automation quietly fails.
- AI Penetration Testing: What It Actually Does (and Doesn’t)How AI penetration testing works, where autonomous agents beat manual pentests, and where they don’t. A practitioner’s guide, not hype.
Methodology
- What Is White Box Penetration Testing? A Complete GuideWhite box penetration testing gives testers full access to source code, architecture, and credentials for deep coverage — plus white vs black vs grey box.
- Penetration Testing Steps: The 7 Phases ExplainedA step-by-step guide to the penetration testing process — from scoping and reconnaissance to exploitation, reporting, and retest, plus how long it takes.
- Penetration Testing Methodology: The Phases That Actually MatterA practical penetration testing methodology — recon to reporting — mapped to PTES, OWASP, and NIST SP 800-115, the way a real engagement runs.
- Black-Box Penetration Testing: Attacking From the Outside InWhat black-box penetration testing is, how it compares to white- and grey-box, and how to run one that mirrors a real attacker.
By Target
- What Is API Penetration Testing? A Complete GuideAPI penetration testing finds and proves exploitable flaws in your APIs — BOLA, broken auth, data exposure. Methodology, OWASP API Top 10, and tools.
- What Is Mobile Application Penetration Testing? A Complete GuideMobile application penetration testing finds and proves exploitable flaws in Android & iOS apps. Learn the methodology, OWASP MASVS, tools, vulnerabilities, and cost.
- What Is Network Penetration Testing? A Complete GuideNetwork penetration testing explained: internal vs external testing, the vulnerabilities it finds, methodology, tools, and continuous automated coverage.
- What Is Web Application Penetration Testing? A Complete GuideHow web application penetration testing works: the OWASP Top 10 flaws it hunts, WSTG methodology, tools, and when automated continuous testing fits.
Buying Guide
- Top Penetration Testing Companies in 2026 (Compared)The top penetration testing companies of 2026 compared by testing model — consultancy, PTaaS, crowdsourced, and autonomous AI — with a buyer’s rubric.
- Penetration Testing as a Service (PTaaS): What It Is and When It FitsWhat PTaaS is, how it differs from a one-off pentest, what it costs, and when a subscription model actually makes sense — and when it doesn’t.
- How Much Does a Penetration Test Cost? A Buyer’s BreakdownWhat drives penetration testing cost, real 2026 price ranges by scope, hidden fees to watch for, and how to get an apples-to-apples quote.
- Penetration Testing Services: How to Buy One Without Getting BurnedHow to choose a penetration testing service — scope, evidence quality, retesting, and the questions that separate real testing from a scan-and-PDF.
Compliance
- Vulnerability Assessment and Penetration Testing (VAPT): The Difference That MattersVulnerability assessment vs penetration testing — what VAPT really means, when you need each, and how auditors expect them to fit together.
- PCI DSS Penetration Testing: What Requirement 11.4 Actually DemandsWhat PCI DSS v4.0 requires for penetration testing (Req 11.4): scope, segmentation checks, retest evidence, and how to pass your QSA the first time.