# Penetration testing

> Penetration testing for web apps, networks, Active Directory, APIs and cloud: report with CVSS scores, evidence and a remediation plan. Get a pentest quote.

URL: https://secureitsolutions.ro/en/penetration-testing/  
Updated: 2026-11-01  
Source: secureitsolutions.ro

**Penetration Testing (Pentest) for Web Applications and Infrastructure**

A penetration test is a simulated, controlled attack on your company's systems. It shows which vulnerabilities can actually be exploited, with what impact and in what order they should be fixed. Pricing is set based on scope.

Price: On request, once the scope is defined (The price depends on the number of applications, endpoints and IP addresses tested, the approach (black-, grey- or white-box) and the number of locations.)

## What’s included

- **Web application pentest.** Websites, portals and SaaS applications: OWASP Top 10, business logic, authentication, sessions, file uploads and TLS configuration.
- **Infrastructure and network pentest.** Perimeter, servers, firewall, segmentation and Active Directory, with external, internal and assume-breach testing.
- **API and cloud pentest.** REST and GraphQL APIs, plus IAM, storage and network configuration in AWS, Azure or Google Cloud.
- **Mobile apps and Wi-Fi.** iOS and Android apps before release and corporate wireless networks, including guest network isolation.
- **Social engineering.** Targeted phishing simulations that show how employees react, as part of your security awareness program.
- **Report and retest.** Executive and technical report with a CVSS score and evidence for every vulnerability, plus a free retest of critical findings after remediation.

## What is a penetration test

A pentest is different from an automated scan. A scanner finds known vulnerabilities; a specialist checks whether they can be exploited and how an attacker might chain several small weaknesses into a successful attack. The result is not a list of hundreds of generic alerts but a focused set of issues with proven impact and clear remediation steps.

We follow recognized methodologies: OWASP for web applications, PTES and NIST SP 800-115 for infrastructure.

| Aspect | Vulnerability scan | Penetration test |
|---|---|---|
| How it is done | automated, recurring | manual and automated, point-in-time |
| What it finds | known vulnerabilities | vulnerabilities and exploit chains |
| Confirms exploitation | no | yes, with evidence |
| When | monthly or quarterly | yearly and after major changes |

### Web application penetration testing

We test the OWASP Top 10, business logic (price manipulation, race conditions, limit bypasses), authentication and authorization including MFA, JWT and IDOR, API security, cookies and sessions, security headers and file uploads. The APIs behind the application are part of the same scope. We recommend a grey-box approach, with regular user access, as a good balance between coverage and cost, and white-box, with source code access, for critical applications.

### Infrastructure and Active Directory penetration testing

We check the perimeter (exposed ports and services, VPN, open RDP or SSH), network segmentation, servers and Active Directory, the main target in most attacks. We also test whether an attacker could reach your backups and whether existing monitoring detects the activity. An external pentest for 5–20 public IP addresses takes 5–10 days, and an internal one covering 100–500 endpoints takes 10–15 days.

## What you get and what comes next

The report includes an executive summary for management, a detailed list of vulnerabilities with CVSS score, evidence and recommendation, a testing timeline and, where relevant, a mapping to NIS2, ISO 27001 or GDPR.

After the pentest we can take over ongoing protection through [cybersecurity and business continuity](/en/cybersecurity-business-continuity/) and the documentation through [NIS2 and GDPR compliance](/en/nis2-gdpr-compliance/). You work directly with us, and we sign an NDA before the scoping call on request. [Request a pentest quote](/en/#quote).

## How we work

1. **Scope and rules of engagement.** We agree in writing on the systems in scope, permitted methods, testing windows and emergency contacts.
2. **Reconnaissance and discovery.** We map the attack surface and combine automated scanning with manual analysis to eliminate false positives.
3. **Controlled exploitation.** We confirm that vulnerabilities can be exploited and how far an attacker could get, without operations that could affect production.
4. **Report and debrief.** We present the results to management and the IT team and retest critical vulnerabilities after remediation.

## Frequently asked questions

### How long does a pentest take?

It depends on scope. A small web application with fewer than 30 endpoints takes 5–7 working days, and a mid-sized network infrastructure 10–15 working days. Add 3–5 days for reporting.

### How much does a pentest cost?

The price depends on scope: a single small web application can be tested in a few days, while a full assessment of a mid-sized company with several locations takes a few weeks. After the scoping call you receive a fixed-price quote, in euros + VAT.

### Can a pentest affect production systems?

The risk exists, but it is controlled. We agree in advance on prohibited operations, such as DoS attacks or heavy fuzzing against production servers, and work within agreed windows. For critical systems we test on a copy or outside business hours.

### How often should we run a pentest?

We recommend at least once a year, plus after major changes: a cloud migration, a new application, an Active Directory restructuring. For organizations in scope of NIS2 or pursuing ISO 27001, the frequency is part of the compliance plan.

### Does the pentest include remediation?

As standard we deliver the report with recommendations and retest critical vulnerabilities. Remediation can be done as a separate project or under a cybersecurity contract.

Get a quote: https://secureitsolutions.ro/en/#quote