Expert services from a CREST certified penetration testing company

A penetration test, often called a pen test or pentest, is a methodical simulated attack on your IT infrastructure, with the aim of discovering security vulnerabilities. The methods and tools of the security testing vary depending on what’s being tested, such as network, systems, web apps, mobile apps or the cloud. Pen testing is requirement of many compliance standards, including PCI DSS, ISO, SOC 2, HIPAA, FTC & more.

Vulnerability scanning, sometimes called automated penetration testing, uses scanning software to methodically and simply scan for a list of known vulnerabilities. Penetration testing on the other hand uses in depth analysis and human ingenuity to uncover security flaws that can’t be found by vulnerability scanning alone.

Automated testing and vulnerability scanning are an important part of your defences, such as helping regular patching, whereas a penetration test provides detailed reporting and remediation advice from cyber security experts. Penetration testing companies will use both tools in their arsenal to make sure your business is protected against cyber threats.

Pentesting engagements vary in their duration depending on the scope of the test. There are several factors to consider, such as if the pentest is internal or external, network size and complexity, and how much information is disclosed upfront. Bulletproof’s dedicated SaaS portal powers our intelligent reporting, meaning that more time is spent delivering penetration testing services, and less time taken up by report writing. This means your business gets a better understanding of the results, and your test is more cost effective.

Bulletproof penetration testing is specifically designed to safely identify and exploit vulnerabilities with minimal risk of disrupting your business operations. Testing can be also performed against a non-production replica of your live environment, such as a UAT/QA environment. A common specification on testing is ‘no denial of service (DoS)’, meaning tests will have a negligible impact on your day-to-day operations.

Bulletproof has innovated our own technology solutions so that almost all types of penetration testing can be performed remotely. Whereas other providers will insist on on-site access for their pentesters, Bulletproof can perform pen testing services remotely.

As a trusted penetration testing service provider, Bulletproof offers a variety of pen tests, as one-offs to spot check your security or on a recurring basis as part of an on-going security strategy. The exact type of penetration test you require depends on your security objectives and compliance needs, such as PCI DSS pen testing. We often find that combined testing – such as a mix of web application and infrastructure/network security testing – gets the best outcome..

Penetration testing projects vary in length and complexity depending on a number of factors, including what apps and infrastructure are being tested, the aims of the test, and the testing parameters. As a leading UK penetration testing service provider, we take the time to understand your aims and objectives, so we can scope a best-fit security test that delivers value for money. As a specialist penetration testing company, we have dedicated pentest scoping experts to help you get the best outcome for your pen test.

Best practices, compliance standards and security professionals all agree that penetration testing should be conducted at least once a year. In addition, extra pentesting should be performed upon significant change or upgrades to your infrastructure. This schedule of security testing is even mandated by certain compliance standards, including PCI DSS.

CREST is an internationally recognised body that promotes the highest standards of security testing. Bulletproof is a member of CREST for penetration testing and security scanning, and our expert pentesters additionally individually hold CREST certifications. Selecting a CREST certified penetration testing company gives you confidence that your pen testing services will be carried out to the highest technical and ethical standards.

At the end of the technical operations, the lead pentester assigned to you will create the comprehensive report and make it available in the Bulletproof threat management portal. The report will detail each threat, the business impact, likelihood of exploitation, how easy it is to fix. Crucially, remediation guidance is included for each and every pen test finding, and the dashboard makes tracking remediations easy. This makes it easier and quicker to improve your security posture. A thorough debrief call is also available, depending on the scope of the test.