PenTest.WSOffensive security,
by referral.
PenTest.WS provides penetration testing and red team engagements privately, to vetted clients, under NDA. We take on new work by referral only.
Six disciplines.
One standard.
Web application and API assessments
Manual, authenticated testing of web applications and the APIs behind them, role by role. The business logic and access control flaws that scanners cannot reason about.
Network penetration testing
External testing of what you expose, and assumed-breach internal testing from a foothold you provide: what is reachable, and how far an attacker can go from there.
Hybrid identity and Active Directory
Attack paths across on-premises AD and Entra ID: delegation, certificate services, credential exposure, sync and trust abuse, and the route from a standard user to full control.
Open-scope red teaming
Adversary emulation against your people, process and technology. We measure whether you detect and respond, not just whether we get in.
Social engineering
Phishing, pretext calls and help desk impersonation, designed around your real workflows and run to show where people and process give way.
Physical intrusion
Covert entry testing of offices and facilities: badge and access control bypass, tailgating and what an intruder can reach once inside.
Senior operators.
No subcontractors.
Every engagement is run by senior operators who break into production systems for a living. The people on the scoping call are the people doing the testing.
We never subcontract, never staff an engagement with juniors learning on your network, and never hand your data to a third party.
Quiet, scoped
and accountable.
Referral and NDA
Every engagement starts with an introduction from someone we know, and an NDA before any detail changes hands.
Scoping
A call with the operators who will do the work, to agree targets, objectives and constraints.
Rules of engagement
Written scope, testing windows, contacts and escalation paths, signed off before testing begins.
Testing
Manual, hands-on work by senior operators, with critical issues raised as they are found.
Report and readout
A written report and a live walkthrough with your stakeholders.
Retest
Once you have remediated, we verify the fixes and update the report.
What you
walk away with.
- Executive summary
- Risk in plain language for leadership: what was tested, what was found and what matters most.
- Technical report
- Every finding with evidence, impact, reproduction steps and remediation guidance your engineers can act on.
- Readout call
- A live walkthrough with your stakeholders, from leadership to the engineers who own the fixes.
- Retest
- We retest remediated findings and update the report with the results.
- Attestation letter
- A letter confirming the engagement and its scope, for auditors, customers and partners.
Built on our
own platform.
We run every engagement in Neuron, the platform we build for penetration testing teams. Findings, evidence and reports live in one controlled system, not in scattered documents and spreadsheets.
We work in regulated and public-sector environments, and adapt to your rules of engagement, data handling requirements and change windows.
Request an engagement.
Tell us who referred you and what you need tested. We will come back to you to arrange an NDA and a scoping call.
Every request is read by a person, and referrals are confirmed.
Your environment, your objectives, your constraints.
Scope, approach, timeline and rules of engagement.