A penetration test shows how an attacker could actually get in and what they could reach. We test the way a threat actor would, then give you findings ranked by what to fix first.
External testing attacks your internet-facing systems from the outside. Internal testing shows what an attacker, or a malicious insider, could reach once they are on your network.
External, internal and segmentation testing aligned to requirement 11.4 of PCI DSS v4.0.1, reported in a form your assessor can use.
Authentication, access control, input handling and business logic in the applications and APIs your customers and staff rely on.
Identity, configuration and access weaknesses in cloud and Microsoft 365 tenants, plus goal-based red team exercises that test whether you would notice an intruder.
We plan and run engagements using recognized references: the Penetration Testing Execution Standard (PTES) and NIST SP 800-115 for process, the OWASP Top 10 and OWASP Application Security Verification Standard for applications, and PCI DSS v4.0.1 requirement 11.4 where payment card testing applies. Standards guide coverage. Skilled analysts do the testing by hand, because that is how chained weaknesses are found.
Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors. Core-Infosec provides penetration testing and PCI readiness support. We do not perform PCI validation assessments.
Tell us what you want tested and why, and we will talk through scope, timing and what a useful report looks like for your team. Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day.
Penetration testing is performed only with written authorization.