Operator-Driven Penetration Testing.

Most external engagements run one to two weeks depending on scope. Internal and full-scope engagements typically take two to three weeks since they involve deeper enumeration inside your environment. You'll get a specific timeline during scoping, before any contract is signed.

The goal is zero disruption to production systems. Rules of engagement are set in writing before testing starts, including blackout windows around anything business-critical. If a specific test carries any risk of instability, we flag it and get explicit sign-off before running it.

For external testing, none. We start from the same position as an outside attacker: your public domain and IP ranges. Internal and full-scope testing needs either physical or remote access to your network, which we'll coordinate with your IT team during scoping.

It might, and that's useful information either way. If your monitoring catches us, that tells you your detection is working. If it doesn't, that's a finding too. We can coordinate timing with your security team in advance if you'd rather they know a test is in progress.

External tests what's reachable from the open internet: your website, VPN, email security, exposed services. Internal simulates what happens if an attacker, or a compromised employee account, is already inside your network. Full-scope combines both to show the complete path from outside access to internal compromise. If you've never had a test before, external is the standard starting point.

A written report with an executive summary for leadership, technical detail for whoever's fixing things, and every finding ranked by actual business impact rather than raw severity score. You can request a redacted sample report before committing to anything.

Yes, a retest is included at no extra cost until findings are resolved. We're not going to charge you twice to confirm your own fix worked.

No. A vulnerability scan flags known issues automatically and stops there. A penetration test goes further: confirming which findings are actually exploitable, chaining smaller issues into a real attack path, and showing you the actual business impact rather than a list of CVEs.

Either works. Production testing shows your real exposure, but we scope carefully around anything that could affect real users or data, for example avoiding destructive actions on a live database. If you'd rather isolate testing entirely, a staging environment that mirrors production is also fine.

We scope and rate-limit testing specifically to avoid this. Anything with a risk of performance impact, like heavier automated scanning, gets scheduled during low-traffic windows if needed.

Neither is required, but either helps. Black-box testing (no source access) shows exactly what an outside attacker sees. If you give us source access or API documentation, we can dig deeper into logic flaws that black-box testing alone might miss. We'll recommend the right approach during scoping.

Yes, if you want that in scope. You'll provide test accounts at different privilege levels (standard user, admin, etc.) so we can check for authorization issues like one user accessing another user's data.

A point-in-time test still covers your core architecture and logic, which doesn't change every release. For applications with frequent deployments, EASE's continuous external monitoring is a better fit to catch new exposure as it appears, alongside a periodic deeper penetration test.

OWASP Top 10 as a baseline, plus manual testing tailored to your actual language and framework: authentication and session handling, injection, file upload and remote code execution paths, business logic abuse, and directory traversal. Automated scanning catches the obvious; the manual work is where the real findings come from.

If your mobile app talks to the same API, that's in scope. Dedicated native mobile app testing (iOS/Android binary analysis) can be scoped as an add-on, ask during your consultation.

For most wireless assessments, yes. Physical proximity is part of how these attacks actually work (handshake capture, rogue access points, evil twin attacks), so we coordinate a visit during scoping.

We schedule around your operating hours where possible and flag anything with a risk of disrupting connectivity in advance. Deauthentication-based tests, for example, are scoped and timed carefully since they can briefly interrupt connected devices.

That's outside the scope of a standard wireless assessment, which focuses on infrastructure you control: office networks, guest networks, and any company-managed access points. Remote worker security is typically better addressed through endpoint and identity controls.

They can be, if you want them in scope. IoT and OT segments often sit on flat, unsegmented networks, which is exactly the kind of exposure worth testing. Let us know what's in your environment during scoping and we'll build it into the assessment.

Not for the core assessment. We test from an outside attacker's position first: no credentials, just proximity. If you also want your WPA2-Enterprise setup or internal segmentation tested more deeply, that's a separate, credentialed phase we can scope in.

No, and that's the point. The value of a social engineering assessment is measuring real, unprompted behavior. Leadership is looped in beforehand for authorization, but the test only works if it's a surprise to the people being tested.

That's your call, not ours, but we'd steer you away from it. The goal is to measure and improve your organization's resilience, not punish individuals for a mistake almost anyone could make under the right pretext. Most clients use the results for targeted training instead of disciplinary action.

If someone hands over live credentials or clicks something that could represent immediate risk, we flag it to your designated point of contact right away. Lower-risk findings, like someone opening a tracked email, go into the full report at the end.

Yes. Scope is entirely up to you, whether that's excluding specific individuals, focusing on one department, or covering the whole organization.

Both, if you want. Standard engagements usually include phishing and pretext phone calls (vishing). Physical testing, like badge cloning or attempting to walk into your office, is available as an add-on and scoped separately since it carries its own legal and safety considerations.

Everything is scoped and authorized in writing before we start, including a get-out-of-jail letter your team can use if a test is ever questioned in the moment. We don't impersonate law enforcement, emergency services, or anyone else that would cross a legal line.