Penetration testing
Basic penetration testing for small businesses
Most small businesses never have their website or customer portal tested until something goes wrong. A basic penetration test is a fixed-scope check of one internet-facing system, done by hand, that finds the serious weaknesses attackers try first and tells you in plain language what to fix.
Made for the business that has never been tested
Not a scanner report and not a month-long engagement: a proper hands-on test, sized to one system.
- You run a website, online shop or customer portal that holds personal information
- A client, insurer or tender has asked whether your systems have been security tested
- Nobody has ever tested your system and you want to know where you stand
- A full penetration test is more than you need, or more than this year’s budget allows
What the basic test covers
The exact scope is agreed in writing before anything is tested. This is what it usually includes.
What the internet can see
Open ports and exposed services, the TLS certificate and its configuration, security headers, and software versions with known, published vulnerabilities.
Logins and accounts
Password and lockout handling, sessions that last too long or can be stolen, and password-reset flows that let the wrong person in.
One customer reaching another
Using two test accounts, whether one logged-in customer can see or change records that belong to another - one of the most common causes of real data leaks, and one no scanner finds.
Common web weaknesses
Injection, cross-site scripting, exposed admin pages and backup files, and error messages that give away how the system is built.
How it works
Agree the scope
We confirm in writing which system is tested, from which accounts, and when. Nothing is tested without written permission from the owner of the system.
We test
By hand, inside the agreed window, and non-destructively. Anything that could disrupt a live system is left out unless you agree to it, or run against a test copy if you have one.
Report and walkthrough
You get the report and a session to go through it, so you know what each finding means and what to fix first.
Fix and retest
Once your developer has fixed the findings, we test them again. A fix is not a fix until it has been checked.
What you get
- A plain-English summary of what was found and what to fix first
- Every finding ranked by real risk to your business, not scanner severity
- Steps to reproduce each finding, and how your developer should fix it
- A walkthrough of the results, and a retest once the fixes are in
What a basic test does not cover
- Internal networks, office devices and Wi-Fi
- Phishing and other social engineering
- Source code review
- Compliance certification - a test supports POPIA or PCI work, it does not certify it
Basic or full penetration test?
Start with the basic test if you have one system and have never had it tested. Choose the full engagement when there is more at stake.
Basic penetration test
- One internet-facing website or web app
- Tested from outside, plus two logged-in test accounts
- The common, serious weaknesses attackers try first
- A clear scope and a quote agreed before testing starts
Full penetration testing
- Several applications, APIs and infrastructure
- Every user role, including administrators
- Business-logic flaws specific to how your system works
- Suited to regulated or high-value platforms
Basic penetration testing: common questions
What is a basic penetration test?
A hands-on security test of one internet-facing system - usually your website, online shop or customer portal - against the common, serious weaknesses attackers try first. It is a fixed scope, so you know before we start exactly what is tested and what it costs.
How is it different from a vulnerability scan?
A scanner produces a long list of possible problems and cannot tell which are real. We test by hand, confirm what is actually exploitable, and look for flaws scanners structurally miss, such as one customer being able to see another customer’s records.
Will testing disrupt our website?
It should not. Testing is non-destructive and happens inside a window agreed in writing. Anything that could affect a live system is left out unless you agree to it, and we keep an open channel throughout so anything unexpected stops immediately.
Do you need our permission to test?
Yes, in writing, from whoever owns the system. If it runs on a hosting or e-commerce platform, we also check that provider’s testing policy while agreeing the scope. Testing a system without authorisation is unlawful under South Africa’s Cybercrimes Act, so nothing is tested until the scope is signed off.
How much does a basic penetration test cost?
It is quoted for the agreed scope before testing starts, so you know the cost up front. Tell us what you would like tested and you will get a price for exactly that.
What if we need more than a basic test?
Then a full penetration test is the better fit: several applications, APIs and infrastructure, every user role and the business logic specific to your system. A basic test is also a sensible first step - many of its findings carry straight into a larger engagement.
Find out where you stand
Tell us which system you would like tested. You will get a written scope and a quote, and nothing is tested until you have signed off on both.
A reply from a developer. Not a sales pipeline. The person who reads your message is the person who would do the work.
An honest answer on fit. If an off-the-shelf product solves your problem better than a custom build, we will tell you which one.
No obligation. A first conversation costs nothing and commits you to nothing. Discovery output is yours either way.