How often should you run a penetration test?
What PCI DSS, Joint Standard 2, POPIA and ISO 27001 expect, and a testing rhythm you can defend.
5-page PDF · free with your work email
Home / Services / Penetration testing
Penetration testing
Find the way in before an attacker does.
Our testers attack your systems the way a real adversary would, with your written permission and inside rules we agree up front. You see exactly what they reached, how they got there and what to fix first. Every engagement is quoted as a fixed fee after a free scoping call.
What we test
Every way in, tested the way an attacker would.
External
External network
Your internet-facing servers, VPNs, firewalls and exposed services, attacked from outside.
Internal
Internal network
An attacker already inside: moving sideways, escalating privileges, reaching Active Directory.
Applications
Web applications
Logins, sessions, injection and business-logic flaws, tested against the OWASP Top 10 and ASVS.
Applications
APIs
REST and GraphQL endpoints checked for broken authorisation, data leaks and missing rate limits.
Applications
Mobile apps
iOS and Android apps and the back ends they talk to, tested against OWASP MASVS.
Cloud
Cloud and Microsoft 365
Azure, AWS and Microsoft 365: identities, storage, keys and settings that leave doors open.
On site
Wireless
Staff and guest Wi-Fi, network separation and rogue access points at your premises.
People
Social engineering
Phishing simulations and pretext calls that test people and process, reported without naming individuals.
How much we know going in
Choose the view you want tested.
Black box
Only your company name. The view of a stranger on the internet.
Grey box
A normal user's login. The view of a customer, an insider or a stolen password.
White box
Code, diagrams and admin access. The most findings per testing day.
How an engagement runs
Five steps, agreed in writing before we start.
- 01ScopeA free call to agree targets, dates and rules.
- 02AuthoriseYou sign off in writing before testing starts.
- 03TestHands-on testing. Critical issues flagged the same day.
- 04ReportFindings, evidence and fixes, walked through with you.
- 05RetestWe check your fixes and confirm them in writing.
What you receive
Evidence you can act on, and show others.
- A plain-language summary for your board and executives
- Every finding rated by CVSS, with evidence and steps to reproduce
- A prioritised fix plan your IT team or provider can work from
- A retest letter for auditors, insurers and clients
Recognised methods
Tested to published standards.
PTESOWASP WSTGOWASP ASVSOWASP MASVSNIST SP 800-115MITRE ATT&CKCVSS severity scoring
Where a test helps you comply
One test, evidence for several rules.
| Requirement | What a penetration test gives you |
|---|---|
| POPIA, section 19 | Evidence that your security safeguards work, which section 19 says you must regularly verify. |
| Joint Standard 2 of 2024 (FSCA and PA) | Penetration testing after major changes to internet-facing systems, and at least annually, required of financial institutions since 1 June 2025. |
| PCI DSS v4, requirement 11.4 | External and internal tests at least every 12 months and after significant changes, with findings fixed and retested. |
| ISO/IEC 27001:2022, control 8.8 | Proof that technical vulnerabilities are found, assessed and treated. |
A summary, not legal advice.
Go deeper
Read the executive briefing.
A plain-language PDF for your board, with sources. Free with your work email.
Next step
Request a vulnerability & compliance scoping call.
We agree what to test and send you a fixed-fee quote. No obligation.
Prefer email?
hello@enc0ded.africa