Penetration testing, grouped by what you need tested.
Four areas: the applications you ship, the infrastructure they run on, the cloud accounts and tenants behind them, and the people and detection that defend them. Each test is led by a person, backed by proof and followed by a retest.
- Four areas
- Led by a person
- Followed by a retest
Application security
Web, API, mobile, desktop and AI features: authorisation, business logic and data exposure.
Explore →Infrastructure testing
What the internet can see, and what a normal domain user can become inside the network.
Explore →Cloud security
Identity, configuration and attack paths in Azure, AWS, GCP and Microsoft 365.
Explore →Adversary simulation
Red teaming, social engineering and physical intrusion that test detection, people and process.
Explore →Application security
For products where one customer, user or role might reach data or actions that belong to another. Overview of application security.
Web application testing
Authentication, authorisation between roles and tenants, injection and business-logic abuse.
Explore →API security testing
REST and GraphQL APIs tested for object-level authorisation, data exposure and chained abuse.
Explore →Mobile application testing
Android and iOS apps with their backend APIs.
Explore →Desktop and thick-client testing
Electron and classic clients: IPC, local secrets and update channels.
Explore →AI and LLM security testing
Prompt injection, tool abuse, data leakage and authorisation failures.
Explore →Infrastructure testing
Book the external test for what the internet can reach, and the internal test for what happens after a foothold. One does not include the other. Overview of infrastructure testing.
External infrastructure testing
Internet-facing hosts, remote access, DNS and email authentication.
Explore →Internal network and Active Directory
From a standard user to domain control: credentials, escalation and lateral movement.
Explore →Wireless penetration testing
Wi-Fi authentication, segmentation, rogue access points and the path inside.
Explore →Cloud security
Configuration review plus attack-path testing, so findings show what an identity could actually reach rather than a benchmark score. Overview of cloud security.
AWS security assessment
IAM, cross-account trust, exposure and data access in your AWS accounts.
Explore →Azure security assessment
Role assignments, identities, exposure and data in your subscriptions.
Explore →GCP security assessment
IAM bindings, service accounts and exposure in your projects.
Explore →Microsoft 365 security assessment
Identity, email, sharing, devices, data and app permissions in your tenant.
Explore →Multi-cloud security assessment
AWS, Azure and GCP reviewed together, with attack paths across them.
Explore →Microsoft Cloud Readiness Assessment
Azure and Microsoft 365 review with a controlled breach assessment.
Explore →Adversary simulation
Exercises that test people, process, premises and detection as well as technology. For an example from a stated foothold, see the assumed-breach case study. Overview of adversary simulation.
Red team assessment
Objective-led attack simulation that measures detection and response.
Explore →Assumed breach assessment
Starts from a user account, laptop or VPN foothold and tests how far an attacker could get, and what is detected.
Explore →Social engineering and phishing
Controlled phishing and pretext campaigns that test people, process and email controls.
Explore →Physical penetration testing
On-site intrusion under a signed authorisation letter: tailgating, badges, locks, reception pretexting, device drops and response observation.
Explore →How each test runs
EVERY ENGAGEMENT
-
Scoped first
A short scope review sets the surfaces, roles and rules before testing starts. -
Proof of impact
Findings that matter are reproduced and explained in plain terms, with severity based on what a realistic role could reach. -
Retest included
Fixes ready within 6 months of the original test (up to 10 issues) are checked again. -
Evidence, not certification
Reports support SOC 2 and ISO 27001 evidence. PoCForge does not claim CERT-In empanelment.
Questions
Which area should I start with?
Start with the system that holds customer data. If you are unsure, name the product on the contact form and we will suggest a scope.
Does one test cover several areas?
Only what is named in the scope. A web test does not include a cloud review, and an external test does not include Active Directory, unless you add them.
Where is pricing?
See the pricing page. Final quotes depend on scope.
Not sure which test fits?
Send a short description of the system and what worries you. We reply with a suggested scope.
