Real‑time penetration test reporting

With our real-time insight feature, you don’t have to wait until the end of the test. As our testers work, each finding goes through a short internal quality check before being shared. Once validated, it’s immediately pushed to you through our online platform allowing you to track them and take early action — even before the final report is delivered.

Want to learn more about how our platform lets you monitor and evaluate your application’s security in real time during testing? Discover our blog about our Penetration Test Reporting with Real-Time Insight

Web application penetration testing focuses on identifying security vulnerabilities in web-based applications, such as login forms, user inputs, APIs, and session management. It targets application-specific risks like SQL injection, cross-site scripting (XSS), broken authentication, and insecure configurations. The goal is to uncover flaws that could be exploited through the web interface.

Network penetration testing, on the other hand, assesses the security of the underlying network infrastructure, such as servers, routers, switches, and firewalls. It can be conducted externally (from outside the organization) or internally (from within the network) and focuses on vulnerabilities like open ports, outdated software, misconfigurations, and weak credentials.

In short: web app testing targets the software layer, while network testing targets the infrastructure layer.

External penetration testing simulates an attack from outside your organization’s network, typically over the internet. It focuses on publicly accessible systems such as web applications, email servers, firewalls, or VPNs, assessing how vulnerable they are to external threats like hackers or malicious bots.

Internal penetration testing, on the other hand, simulates an attack from within your network, such as from a compromised employee device or a malicious insider. It evaluates what an attacker could access if they bypassed external defenses or had internal access, focusing on internal systems, network segmentation, and privilege escalation. TSF never requests credentials for this type of test and always performs the assessment without initial access to accounts.

Together, both approaches provide a comprehensive view of your organization’s security posture

The ideal frequency for penetration testing depends on your industry, the sensitivity of your data, and how attractive your systems are to potential attackers.

For organizations handling highly sensitive information, such as financial services, healthcare, or government agencies, it’s recommended to conduct penetration tests multiple times per year. This helps ensure you’re staying ahead of evolving attack methods.

For companies in less sensitive sectors, penetration tests should still be performed regularly, especially after significant changes, such as launching a new application version, adding key features, making major infrastructure changes (e.g. new firewalls, cloud migrations), or reorganizing your network.

Penetration testing isn’t just about identifying technical vulnerabilities. It’s also a valuable way to assess how well internal teams, like IT, development, and security, are working together to maintain a secure environment. It should be viewed not as a one-time event, but as an ongoing best practice integrated into your security strategy.

In short, test regularly, and always test when something significant changes.

A security (vulnerability) scan is an automated process that identifies known vulnerabilities in your systems. It provides a broad overview of potential issues, such as outdated software, misconfigurations, or exposed services, by comparing your environment against a database of known threats. It’s a great first layer of defense and is useful for routine checks. However, it typically does not confirm whether those vulnerabilities can actually be exploited or what their real-world impact might be.

In contrast, a penetration test (or pentest) is a manual and semi-automated security assessment conducted by skilled professionals. Testers simulate real-world attacks, actively exploiting vulnerabilities to understand their impact, uncover logic flaws or complex attack paths that scanners can’t detect, and provide detailed insight into the actual risks your organization faces. Every pentest is customized to your systems and business logic.

In short:

• Security scan = fast, automated, wide coverage, high-level results
• Penetration test = slower, manual, deep analysis, actionable risk assessment

External Penetration Testing

Simulates an attack from outside the organization, targeting publicly accessible assets like websites, mail servers, and firewalls.

Internal Penetration Testing

Mimics an attack from within the network, such as by a malicious employee or someone with internal access, to test what can be done once the perimeter is breached.

Cloud Penetration Testing 

Targets cloud-based infrastructure (AWS, Azure, Google Cloud, etc.) to identify misconfigurations, insecure interfaces, and weaknesses in cloud-specific services.

Web Application Penetration Testing

Focuses on identifying security flaws in web-based applications, including issues like SQL injection, cross-site scripting (XSS), broken authentication, and insecure APIs.

Additional Code Review

As part of our web application tests, we also offer an optional source code review. Not only will testing with application source code result in a much more efficient test. It will also provide the opportunity to detect much more complex issues that typically take a lot longer to find in a normal test.

Mobile Application Penetration Testing 

Focuses on mobile apps (iOS, Android) and their interaction with backend services, checking for insecure storage, weak authentication, and data leakage.

API Testing

Focuses on evaluating the security of application programming interfaces (APIs). The test checks for common vulnerabilities such as improper authentication, lack of encryption, and insufficient access controls. It ensures that APIs are securely handling sensitive data and preventing unauthorized access.

Fat/Thick Client Testing

Focuses on security assessments of desktop applications that are installed on end-user devices. These applications often interact with backend systems and store sensitive data locally. The test evaluates risks such as weak encryption, insecure data storage, or potential vulnerabilities in client-server communication.

Kiosk Breakout Testing

Tests the security of self-service kiosks (e.g., in retail or public spaces) to see if an attacker can break out of the kiosk’s restricted environment. The test evaluates the risk of unauthorized access to the underlying system or network, which could lead to data theft or malware installation.

Wireless Penetration Testing

Tests the security of wireless networks (Wi-Fi), including encryption protocols, rogue access points, and wireless client vulnerabilities.

Digital Social Engineering

Evaluates the human element of security, often through phishing or pretexting to determine how susceptible employees are to manipulation.

Physical Social Engineering 

Assesses physical security by attempting to gain unauthorized access to buildings, data centers, or secure areas.This type of test often includes a health check, where we look for common physical security issues—such as passwords on post-its, unlocked devices, or unattended access badges.

USB Drop Test

Simulates a scenario where malicious USB devices are dropped in public or accessible areas, such as office spaces or parking lots. The test evaluates whether employees are likely to plug in these devices, potentially giving attackers unauthorized access to the network or introducing malware.

Red Team Testing

A full-scope, multi-layered simulation of a real-world attack that combines many of the above techniques over a longer period to test an organization’s detection and response capabilities.

Absolutely. You can schedule a call with one of our advisers, who will review your specific requirements and provide a customized pricing proposal based on your needs.