Know what an attacker would see, before they see it.
Our penetration tests simulate real attacks against your applications, your networks and your staff: injection, privilege escalation, targeted phishing, exploitation of weak configurations. We take the stance of a real attacker to reveal what automated scanners never find.
We do not sell fear. A reported vulnerability is a demonstrated vulnerability; where a risk stays theoretical, the report says so.
The scope is agreed with you and written down before the first request. Nothing outside that scope is tested.
Management gets a short summary: what is exposed, what it would cost, where to start. IT gets the technical detail, proof of exploitation and the fix to apply, ranked by severity and by effort.
No decorative jargon, no hundred scanner alerts copied across: proven holes and workable fixes.
A penetration test is a photograph. Security is maintenance: fixes applied, servers hardened, access reviewed, backups actually restored once a year, and staff trained — people remain the most used way in.
For a Swiss SME the goal is not zero risk: it is not being the easy target, and knowing what to do on the day something gets through.
Destructive tests are excluded by default. Where a check carries risk, it runs on a copy of the environment or is scheduled with you outside business hours.
Yes, signed before anything starts, stating the scope, the dates and the people to notify. A test run without that document is not a test, it is an offence.
Once a year for an SME with no major change, and after every significant one: a new application, a newly opened remote access, an infrastructure migration.
The most common attacks do not choose their victim: they sweep whatever is exposed. A ten-person SME and a thousand-person group are scanned by the same tools, on the same day.
A preliminary conversation to set the scope, the timing and what you actually want to find out.