Pentesting

During a pentest, our hackers examine applications, infrastructure, networks or hardware from an attacker’s perspective, looking for as many relevant vulnerabilities as possible and testing what can be achieved by exploiting them. The assessment is guided by research questions that focus on the risks most relevant to your organisation. This puts individual findings into context and helps determine which weaknesses pose the greatest risk.

Schedule a call
Request a quote

The risks you are facing

What looks secure from the outside can look very different when someone tries to break in.

Attackers are becoming smarter, faster and more scalable

New technologies and AI are giving cybercriminals increasingly advanced capabilities, enabling them to discover and exploit vulnerabilities faster.

Stricter laws and regulations

Consider, for example, the CBW, DORA for the financial sector, BIO requirements and existing GDPR obligations. These regulations increase the pressure on organisations to demonstrate that risks are effectively managed.

Attack paths to critical systems remain hidden

A vulnerability may seem limited in isolation but could give an attacker access to critical systems or sensitive data. Without testing these attack paths, it remains unclear what impact a vulnerability could have in practice.

The attack surface is constantly changing

Agile, DevOps and CI/CD enable applications to be modified and deployed at an increasingly rapid pace. New features, integrations and changes can introduce new vulnerabilities and attack opportunities. A system that passed a security test before may contain new vulnerabilities today.

How we put your security to the test

A pentest is much more than running a scanner and listing vulnerabilities. Our pentesters investigate how weaknesses can be exploited and combined, while a Lead Pentester keeps the test controlled, focused and aligned with your organisation.

Define what you want to test

The pentester defines the scope, objectives, test boundaries and planning together with your team. We document these in a test plan, so everyone knows what we will attack, how we will test it and what is off limits.

Prepare for the pentest

Before the pentest begins, we make sure everything is ready for testing. We verify access, test accounts, environments and technical requirements with your team, preventing unnecessary delays and keeping the available test time focused on what matters: finding vulnerabilities.

Put the scope to the test

Our pentesters search the agreed scope for vulnerabilities, validate their findings and test what can be achieved by exploiting them. The Lead Pentester remains your primary point of contact, keeping you informed as the test unfolds.

Turn findings into insight

Our pentesters compile the findings, their impact and recommendations into a clear pentest report. An separate pentester reviews the report for quality and accuracy, giving you a reliable basis for remediation and security decisions.

Debrief and define next steps

After the pentest, we walk through the report together and discuss the findings in detail. We provide strategic advice on remediation, giving your team a clear understanding of the findings and how to address them.

What we assess

From a single application to a broader attack surface, the scope determines where we look for vulnerabilities and what we put to the test.

External attack surface

Discover what an attacker can find and access about your organisation from the internet. The test covers areas such as domains, IP addresses, external services, cloud environments, VPNs and management interfaces. This reveals whether vulnerabilities and insecure configurations could provide access to accounts, data or underlying systems.

Internal networks

Discover what an attacker could reach with access to your internal network or a compromised account. The test covers areas such as network segmentation, Active Directory, permission structures and management interfaces. This reveals whether an attacker could escalate privileges, move laterally through the network and gain access to critical systems or data.

Applications

Get a clear view of the security of your web applications, APIs, mobile apps or Mendix applications, including vulnerabilities in custom code, development frameworks, configurations and underlying infrastructure.

Hardware and images

Discover whether weak configurations, insecure interfaces or insufficient hardening in IoT devices, point-of-sale systems and workstation images could give an attacker access to elevated privileges or sensitive data.

Scenariogebaseerde pentesten

Start with a specific attack scenario or security question and find out whether that route can actually be exploited, without testing an entire environment.

Cloud environments

Discover whether your cloud environment is configured according to its intended security boundaries. The assessment covers areas such as identities and access rights, storage, secrets, network configurations and publicly accessible services. This helps uncover insecure configurations, excessive permissions and unintentionally exposed data.

AI applications

Find out how attackers could exploit your AI-powered applications, from models and agents to data flows, integrations and the systems they can access.

Your primary point of contact

“Finding vulnerabilities is only part of the picture. Understanding what can actually be exploited shows where the real risk lies.”

Dirk van Veen

Ethical Hacker & Founder

Ask a question

FAQ

How long does a pentest take?
That depends on the size, complexity and scope of the environment being tested. During scoping, we determine what needs to be tested and agree on a realistic planning before the test starts.
A vulnerability scan automatically looks for known weaknesses. A pentester goes further by manually investigating findings, testing whether vulnerabilities are exploitable and looking for ways to combine them into attack paths.
Every hacker at The S-Unit holds at least an OSCP certification, complemented by specialist certifications in offensive security, web application security, Active Directory and Mendix security. Our pentesting services are independently assessed annually for the CCV Pentesting certification. Our security processes comply with ISO 27001 requirements.
We start with a clear scope, objectives and a technical point of contact. Depending on the test, we may also need test accounts, access to specific environments or other information required to realistically test the agreed scope.

Take your pentest further

Red Teaming

Go beyond a pentest’s defined scope and test whether a realistic attacker can achieve a specific objective without being detected or stopped.
Read more

Threat Modelling

Before looking for actual vulnerabilities in a pentest, map what needs to be protected and how an attacker could target your application, system or process to identify potential threats and attack paths early.

Offensive as a Service

Make pentesting part of your secure development lifecycle by testing the same environment regularly, spreading a broader scope over multiple quarters or aligning pentests with development sprints.
“The S-Unit combines in-depth expertise with a pragmatic approach. They think along critically, communicate clearly and translate their findings into concrete improvements we can act on straight away. It’s a pleasant way of working that helps us strengthen our information security further. And just as important: thanks to them, I sleep a lot better”
Firas Daoud
TAF – CTO
“The S-Unit understood from the start what we wanted to achieve, even though the path to get there wasn’t entirely clear yet. They took us along in their approach, thought ahead and switched gears quickly when needed. We could trust that it would work out, without having to keep steering. It’s a really pleasant way of working together.”
Martijn Korevaar
Gemeente Rotterdam – IT Risk & Compliance Manager
“We didn’t want to be told that we’re vulnerable. We wanted to see how far a real attacker would get. Instead of a standard report, we got insight into exactly the risks that matter most to us.”
Anonymous
Manager Tech Security
“We received professional help with a pentest of a broad application landscape. Despite the many different functionalities in our landscape, the test was fast and thorough.”
Daan van der Ham
Lead techniek - PO-VO Raad

Ready to put your
security to the test?

Whether you already have a scope in mind or are still figuring out what to test, we’ll help define the right offensive approach.
Schedule a pentest