Penetration Test Scoping & Rules of Engagement
We agree targets, test windows and safety limits upfront, so testing is controlled and never disrupts live operations.
- Scope document
- Rules of engagement
Cybersecurity & Risk Management
Penetration Testing Services
Our testers attack your web apps, APIs, networks and cloud accounts the way a real adversary would, then deliver evidence-backed findings, fix guidance and a retest to confirm each issue is closed.
- Web & API testing
- Network & cloud tests
- Evidence-led reports
- Fix verification
- Years of delivery
- 8+
- Years of delivery
- Projects shipped
- 350+
- Projects shipped
- Clients across US, UK, AU & SG
- 200+
- Clients across US, UK, AU & SG
What’s included
Everything You Need to Find Exploitable Gaps Before Attackers Do
Scoped, manual-led ethical hacking across apps, networks and cloud, with clear findings and verified fixes.
-
-
Reconnaissance & Threat-Led Test Planning
We profile your exposure the way a real attacker would, then plan tests around your likeliest attack routes.
- Attack plan
- Asset discovery list
-
Web Application & API Penetration Testing
Manual testing against OWASP Top 10 and API flaws uncovers logic and access issues scanners miss.
- OWASP-aligned findings
- Proof-of-concept evidence
-
Internal & External Network Penetration Testing
We test your perimeter and internal network for exploitable services, weak credentials and lateral movement paths.
- Network findings
- Attack path diagram
-
Cloud & Mobile App Penetration Testing
We test AWS, Azure, GCP configurations and iOS or Android apps for misconfigurations and data exposure.
- Cloud misconfig report
- Mobile test report
-
Social Engineering & Phishing Simulation
We run authorised phishing and pretexting exercises that show how your people and processes hold up.
- Campaign results
- Awareness actions
-
Risk-Rated Pen Test Report & Executive Briefing
You receive CVSS-rated findings with fix steps for developers and a plain-language summary for leadership.
- Technical report
- Executive summary
-
Retainer-Based Pen Test Retesting
After you remediate, we retest to confirm fixes hold, giving you evidence for customers and auditors.
- Retest report
- Closure letter
Need something specific?
Why Kramate
Why Business Owners Choose Kramate for Security Testing
We act like a break-in attempt, so you learn the weak spots before a real thief does.
-
We Test Without Breaking Your Business
Instead of
testing that knocks your website offline
With Kramate
We agree safe times and limits first, and we stop at once if something looks risky.
-
Real People Try to Break In
Instead of: a robot scan sold as a real test
With Kramate: Skilled testers try to get in by hand, the way a real attacker would, and show you how.
-
Findings You Can Show Customers
Instead of: reports that scare you but prove nothing
With Kramate: You get a short summary for leadership and a clear proof for each weak spot we found.
-
Your Results Stay Private
Instead of: worry about who sees your weak spots
With Kramate: We sign a privacy agreement before we start, and only a small named group sees your results.
-
We Check Your Fixes Worked
Instead of: fixing problems and never knowing if it worked
With Kramate: Once your team has fixed the issues, we try again and tell you what still stands open.
Our approach
How Our Penetration Testing Works, Step by Step
A controlled, agreed attack on your systems so you see weak spots before criminals do.
6 clear steps 6 deliverables you keep
-
Agree the Targets
We agree which systems, websites and apps are tested, and which are strictly off limits.
-
Set the Ground Rules
We set test dates, contact people and what to do if something breaks, in writing before we begin.
-
Attacker-Eye Research
We gather the same public information an attacker would use to plan an attack on you.
-
Controlled Attack
Our testers try to break in the way real attackers do, taking care not to harm your live service.
-
Findings Report
We write up each weakness with proof, plain-English impact and clear steps to close it.
-
Test Again
After your team applies fixes, we try the same attacks again to confirm each gap is closed.
Tools & technologies
Technologies We Use for Penetration Testing
We use recognised ethical-hacking tools, matched to the apps, networks and cloud in scope.
- Kali Linux: A toolkit environment used for authorised security testing.
- Nmap: Maps which devices and services are reachable on your network.
- Wireshark: Inspects network traffic to spot misuse and misconfiguration.
- Burp Suite: Tests web apps and APIs for exploitable flaws.
- OWASP ZAP: Automatically scans running web apps for common vulnerabilities.
- Postman: Designs and tests APIs during integration.
- Python: Readable language for business logic, data and automation.
- Metasploit: Safely proves whether a weakness can really be exploited.
- Bash: Shell scripting that automates routine operations tasks.
- OpenSSL: Creates and checks the certificates and keys behind encryption.
- AWS: Amazon cloud hosting and services.
- Azure: Microsoft cloud hosting and services.
- Google Cloud: Google infrastructure for data, AI and applications.
- Prowler: Checks cloud accounts against security best practice.
- MITRE ATT&CK: A shared catalogue of attacker techniques used to plan detection.
- Jira: Tracks work, priorities and delivery progress.
- GitHub: Hosts code and manages reviews, access and branch rules.
Expert guide
Penetration Testing Services: A Complete Guide for Businesses
Penetration testing services put trained testers in the position of a determined outsider, with your written permission, to see whether weaknesses in an application, network or cloud account can actually be used to reach data or systems. The result is a ranked report of confirmed findings, with evidence and fix advice.
It differs from a scan because a person chains small weaknesses together and judges what they mean for your business. That makes it valuable before a major launch, after big changes, and when customers or standards ask for independent testing.
This guide explains test types, how to scope one, what safe testing looks like, how to read the report, regional points for the USA, UK, Australia and Singapore, and how to choose a provider.
What penetration testing services are, and what they are not
A penetration test is a time-boxed, authorized attempt to find and demonstrate weaknesses. Testers follow an agreed scope, record every step and stop short of causing harm. The NIST technical guide to security testing (opens in a new tab) describes the planning, discovery, attack and reporting phases that most methodologies share.
It helps to be clear about what a test is not:
- Not a certificate of safety. It shows what testers found within the time and scope given, not that nothing else exists.
- Not a replacement for routine scanning. Ongoing vulnerability assessment covers breadth, while a test adds depth.
- Not a compliance shortcut. Some standards require testing, but passing a test is not the same as meeting a standard.
Types of penetration testing services
Tests are grouped by target and by how much the testers are told in advance.
| Test type | What it examines | Typical trigger |
|---|---|---|
| Web and API | Login, sessions, access control, input handling, business logic, using the OWASP Web Security Testing Guide (opens in a new tab) as a method | New release or major feature |
| Mobile app | App storage, communication with servers, platform permissions | App launch or redesign |
| Network, internal and external | Exposed services, segmentation, weak credentials and trust between systems | Annual review or network change |
| Cloud | Identity and permissions, storage settings, exposed management interfaces | Migration or new cloud account |
| Social engineering | Staff response to simulated phishing or phone requests, only with leadership approval | Awareness program check |
Knowledge level is the second choice. In a black box test the testers start with almost nothing, like an outsider. In a grey box test they receive a normal user account or limited documentation. In a white box test they see architecture and code. Grey box is often the best value because testers spend time on findings, not on guessing.
Some providers also offer threat-informed exercises built on adversary behaviors cataloged in MITRE ATT&CK (opens in a new tab). They suit mature teams that want to test detection and response, not just prevention.
Scoping a test and agreeing rules of engagement
Good scoping decides most of the value. Before testing starts, agree these points in writing:
- Targets. Exact domains, IP ranges, apps and accounts in scope, and what is explicitly out of scope.
- Authorization. A signed letter from someone with authority over each asset, including third-party hosts, which may need their own permission.
- Timing. Test windows, blackout periods and whether production or a staging copy is used.
- Safety limits. No denial-of-service, no data destruction, and rules for handling any real personal data seen.
- Contacts. A named person on each side and an emergency stop procedure.
- Data handling. How evidence is stored, encrypted and deleted after the work.
Reading the report and acting on findings
A useful report has two audiences. Executives need a plain summary of overall posture and the few issues that matter most. Engineers need, for each finding, a description, the affected asset, evidence, a severity rating with its reasoning, and a recommended fix.
Severity should reflect your context. A moderate weakness on a system holding sensitive data can outrank a high rating on an isolated test server. Findings are often mapped to categories such as the OWASP Top 10 (opens in a new tab) or to MITRE CWE (opens in a new tab) weakness types, which helps developers search for guidance.
Insist on a retest. After fixes, testers should confirm each one worked and issue an updated report. Without it, a closed ticket is only a claim.
How often to test
There is no universal interval. A common pattern is to test after significant changes and on a regular cycle, with the cycle set by risk. Internet-facing systems that hold sensitive data warrant more attention than a brochure site.
Teams that ship often can pair periodic testing with automated checks in the pipeline, as covered in application security testing. Payment environments are a special case: the PCI Security Standards Council documents (opens in a new tab) set testing expectations for organizations handling card data, so read the current requirement and confirm with your assessor.
AI and automation in penetration testing
Automation speeds up reconnaissance, coverage and reporting, and AI assistants can help testers draft notes and summarize large outputs. The creative part, understanding how your particular business logic could be misused, remains human work.
Applications that include AI features add new things to test, such as how a chatbot handles untrusted input or what data it can reach. Ask whether a provider has experience with those cases before including them in scope.
Industry examples
- E-commerce: a grey box test of the checkout and account areas before a seasonal sales period.
- SaaS provider: testing tenant separation so that one customer cannot see another’s records, supporting a customer security review.
- Healthcare: an external and internal network test around systems that hold patient records, run in a quiet window.
- Financial services: a cloud test of a new reporting platform before it receives live data.
These are illustrative scenarios, not Kramate client results.
Regional considerations: USA, UK, Australia and Singapore
- USA: testing needs written authorization; unauthorized access can breach computer misuse laws. Payment, health and financial sectors have their own testing expectations.
- UK: the UK’s NCSC guidance (opens in a new tab) explains how to commission and use penetration testing, and unauthorized access is an offense under the Computer Misuse Act 1990.
- Australia: the Privacy Act 1988 requires reasonable steps to protect personal information, and testing is a recognized way to show them; see the OAIC (opens in a new tab).
- Singapore: the Computer Misuse Act applies, and the PDPC (opens in a new tab) expects reasonable security arrangements for personal data.
Confirm authorization wording and data-transfer limits with legal counsel, especially if testers work from another country. Agree reporting windows that match your time zone.
Cost factors and budget planning
Cost follows tester time, which follows scope and complexity:
- Number and size of applications, endpoints, roles and network segments.
- Depth: black, grey or white box, and whether code review is included.
- Whether authenticated testing across several user roles is needed.
- Retesting, re-reporting and attendance at fix workshops.
- Niche areas such as mobile, cloud or operational technology.
Fixed-price testing suits a well-bounded target. Hourly or dedicated-team arrangements suit continuous programs. A written scope with an itemized estimate is the best protection against surprises.
How to choose penetration testing services
- Named testers and a clear method, not just a scanner export.
- A sample report with sensitive details removed.
- Safe-testing rules in the contract, plus insurance and confidentiality terms.
- Remediation help, including a retest and a call to walk developers through findings.
- Independence, meaning the testers are not selling the products they recommend.
- No guarantees of impenetrability, which no honest provider can give.
How Kramate delivers testing work
We sign an NDA before discussing your systems in detail, then agree scope and rules of engagement in writing. A dedicated project manager coordinates the work, with daily updates on Slack or Teams and a review at the end of each two-week round. Findings and reports are yours, with all intellectual property transferred to you.
Start with a free consultation and receive a detailed estimate within 24 hours, on a fixed-price, dedicated-team or hourly basis. Delivery hours overlap four to six hours with US Eastern time and a full working day with the UK, Australia and Singapore. Details are in our delivery approach, and a cybersecurity consulting engagement can set the wider priorities around the test.
Frequently asked questions
What is the difference between a pen test and a vulnerability scan?
A scan is automated and broad: it lists known weaknesses. A penetration test is human-led and deep: testers try to use weaknesses together, judge business impact and report what was actually reachable. Most programs use both.
How often should you do penetration testing?
Test after significant changes to an application or network, and on a regular cycle based on risk. Systems that are exposed to the internet or hold sensitive data justify more frequent testing than internal low-risk tools.
What is black box versus white box testing?
Black box testers start with no inside information, like an outsider. White box testers receive architecture details and sometimes code. Grey box sits between, with a user account or limited documentation, and is often efficient.
What should a penetration test report include?
An executive summary, scope and method, each finding with evidence and reasoned severity, fix recommendations, and a retest result. Reports without evidence or context are hard for engineers to act on.
How much does a penetration test cost?
It depends on scope, depth, number of roles and whether retesting is included. Kramate provides a detailed estimate within 24 hours of a free consultation, after the scope is understood. Fixed-price, dedicated-team and hourly options are available.
Do we need penetration testing for PCI DSS?
The PCI standards include testing expectations for environments that handle card data. Read the current requirements from the PCI Security Standards Council and confirm scope and frequency with your assessor or acquirer.
Sources and further reading
- NIST SP 800-115 Technical Guide to Security Testing (opens in a new tab)NIST
- OWASP Web Security Testing Guide (opens in a new tab)OWASP
- MITRE ATT&CK (opens in a new tab)MITRE
- OWASP Top 10 (opens in a new tab)OWASP
- MITRE Common Weakness Enumeration (opens in a new tab)MITRE
- PCI Security Standards Council Document Library (opens in a new tab)PCI SSC
- NCSC UK Guidance and Collections (opens in a new tab)NCSC UK
- Australian Privacy Principles (opens in a new tab)OAIC
- Personal Data Protection Commission Singapore (opens in a new tab)PDPC
FAQ
Frequently asked questions
Price depends on scope: number of applications, APIs, IP addresses or cloud accounts, test depth, whether testers have credentials, and whether social engineering is included. Retesting after fixes adds effort. Send us your penetration testing scope and a no-obligation estimate follows within 24 hours.
We agree scope and rules of engagement, gather information, look for weaknesses, attempt controlled exploitation, document findings and present a report with fixes. Duration depends on scope size, complexity and testing windows. A retest verifies your fixes.
Before detailed penetration testing talks, Kramate signs an NDA, and findings are shared only with named contacts. The report, evidence and any scripts written for your test are transferred to you as your IP. Written authorisation precedes any testing.
We agree testing windows, contact points and an emergency stop route. Findings go to your developers with reproduction steps and fix advice in your tracking tool. We can walk through results with engineers so fixes are understood.
Scanning uses automated tools to list known weaknesses. Penetration testing adds human skill to chain weaknesses and prove what an attacker could actually reach. Scans are quicker and repeatable, while pen tests show real impact. Most programmes use both.
Black box gives testers no inside information, like an outsider. Grey box gives limited details such as a user login. White box shares code and architecture. Grey box often gives the best value for time, while white box finds the most. We advise by goal.
At least yearly, and after major releases, infrastructure changes or acquisitions. Some compliance standards and customer contracts also expect regular tests. Applications that change often may need testing built into releases. Production testing is agreed in writing, and sensitive systems can be tested in a staging copy instead.
We plan to keep disruption low by agreeing rules, avoiding destructive actions, testing in quiet windows and starting with safer checks. Some risk remains, which is why we align on backups, contacts and a stop procedure beforehand.
Taking new projects
Let’s talk about your Penetration Testing Services needs
Tell us about your project and get a free consultation and estimate within 24 hours.
- We reply within 4 business hours A real consultant reads your brief — no bot, no queue.
- 30-minute discovery call We dig into goals, constraints and budget. NDA signed on request.
- Proposal in 24 hours Scope, timeline, team and price — clear enough to decide on.
NDA on request You own the IP No obligation Free estimate