Testing and audits

Penetration testing and audits

Name: Guardiso
Price: 199 EUR

A penetration test shows what an attacker could achieve in your network. An ISO 27001, NIS2 or DORA audit shows what is missing to meet the requirements. Either way you get a list of gaps with risk ratings and an action plan.

Request a quote Book a call

What the services cover

External penetration test

A controlled attack on everything your company exposes to the internet, from an outside attacker’s point of view.

An attack surface map: domains, subdomains, addresses and services visible from the internet.
Remote access and email: VPN, remote desktop, mail servers and login portals.
Finding vulnerabilities and controlled attempts to exploit them.
Weak password attempts within the limits set in the test rules.
An assessment of what an attacker would achieve in practice and how far they would get.

Request a quote for this service

Internal penetration test (LAN and Active Directory)

A simulation of an attacker who is already inside the network, for example through an employee’s compromised laptop or an infected attachment.

Network segmentation: whether the office network can reach servers and production systems.
Active Directory: paths to domain admin, Kerberoasting, AS-REP roasting and certificate services (ADCS).
Legacy protocols and settings that make credential theft easier, such as LLMNR and missing SMB signing.
Lateral movement between machines and privilege escalation.
Local administrator passwords, service account permissions and workstation hardening.

Request a quote for this service

ISO 27001, NIS2 and DORA audit

An assessment of compliance and maturity against the chosen requirements. We review documents, interview the people in charge and look at the controls in operation. The result shows where you stand before an ISO 27001 certification audit or a statutory NIS2 audit.

ISO 27001: clauses 4 to 10 and the 93 Annex A controls.
NIS2: the risk management measures of Article 21, incident reporting and management accountability.
DORA: ICT risk management, incidents, resilience testing and ICT third-party risk.
Evidence samples: configurations, permissions, backups and event logs.

Request a quote for this service

Methodologies and standards

Tests follow PTES and NIST SP 800-115, and techniques are described using MITRE ATT&CK so your security team can link them to monitoring. Audits follow the standard and the regulations, with a reference to the specific requirement for every finding.

PTES
NIST SP 800-115
MITRE ATT&CK
CVSS 4.0
ISO/IEC 27001:2022
NIS2
DORA

How we work

Scope and rules

We agree the scope, timing and rules of the test or audit in writing, including exclusions and contacts. We sign a confidentiality undertaking.

Reconnaissance or document review

For a test we map targets and entry points. For an audit we read policies, procedures and registers.

Testing or control review

For a test we run controlled attacks. For an audit we interview the people in charge and check evidence samples.

Report

We hand over a report with the list of gaps, risk ratings and a prioritised action plan.

Debrief and retest

We go through the results with management and the technical team. After the fixes we can check them again.

What you get

A report with the list of gaps and risk ratings.
An action plan with priorities and estimated effort.
A plain-language summary for management.
A results walkthrough and confirmation of fixed gaps after the retest.

What the report contains

For a test: the attack path step by step, evidence, CVSS 4.0 score and MITRE ATT&CK references.
For an audit: each finding with a reference to the clause of the standard or article of the regulation.
A compliance rating for every area.
A remediation plan with priorities, deadlines and estimated effort.

What we need from you

For an external test: a list of domains and addresses in scope.
For an internal test: network access through a laptop or VPN and a standard domain account.
For an audit: access to documentation and time with the people in charge for interviews.
A contact person on your side throughout the work.

Questions and answers

How does an audit differ from a penetration test?

An audit checks whether the company has and follows the required rules, processes and controls. A penetration test checks in practice whether the controls withstand an attack. They work best together.

Is a penetration test required by NIS2 or DORA?

NIS2 requires an assessment of how effective the security measures are and vulnerability handling, and testing is the simplest evidence. DORA explicitly requires a digital operational resilience testing programme, and selected financial entities must undergo threat-led penetration testing (TLPT) every three years.

How long does a test or an audit take?

It depends on the number of addresses, systems and locations. We state the timeline in the quote after a short scoping survey.

Will you help close the gaps after the audit?

Yes. We can close the gaps as part of the vCISO service and run the remediation plan in Guardiso with deadlines and owners.

Let’s start with the scope

Fill in a short scoping survey. We will prepare a quote with timing and delivery approach. Your data is protected by a confidentiality undertaking.

Request a quote Book a call

Other services

vCISO: implementation and certification support Cybersecurity services All services