Vorpcel / Services / Offensive security
We test how an attacker could compromise your applications and infrastructure. Manual testing validates weaknesses, shows their impact and gives your team a clear path to fix them.
At a glance
A scanner can flag a potential vulnerability. A penetration test checks whether it can be exploited within the agreed scope, what access it allows and which data or operations it puts at risk.
We combine automated discovery with manual investigation of authentication, authorization and business logic. Each confirmed finding includes evidence, context and guidance your team can use to remediate it.
Validate a new application, API or mobile release before exposing it to customers.
Check new integrations, permissions and critical workflows after a significant change.
Give customers a technical assessment when they review your security before signing a contract.
Gather evidence of testing for the systems and requirements agreed in scope.
Assess exposure after migrations, network changes or the adoption of cloud services.
Reassess critical assets as your environment and its attack surface evolve.
We test the running application and its interfaces, focusing on the actions and data an attacker could reach.
We assess exposed services and internal paths that could allow unauthorized access or broader compromise.
We investigate how identities, permissions and exposed resources could be combined into an attack path in the agreed cloud accounts.
We assess the mobile client and its communication with back-end services, using the platforms and builds defined in scope.
Scope, access, testing windows and delivery dates are agreed before testing starts. The schedule depends on the assets and depth of the assessment.
We agree on assets, test accounts, exclusions and stop conditions, with written authorization and a technical contact.
We map the agreed attack surface and manually validate findings. Critical issues are communicated promptly through the agreed channel.
We explain the evidence, business impact and recommended fixes to your technical team and stakeholders.
Your team implements the fixes. We validate the agreed findings during the retest window defined in the proposal and update their status.
A clear account of the scope, limitations, main risks and recommended priorities for leadership.
Validated findings with affected assets, evidence, reproduction steps and remediation guidance.
Recommendations ordered by impact and context, with retest status for the findings reviewed in the agreed window.
We define the coverage, depth and retest conditions in the proposal, based on your environment and goals.
| Option | Best for | What it includes |
|---|---|---|
| Focused assessment | A specific application, API or critical workflow | Testing of the selected assets, report and agreed retest |
| Broader assessment | Several systems or an infrastructure boundary | Coordinated testing across the agreed scope, consolidated report and agreed retest |
| Recurring assessments | Teams with frequent releases or periodic validation needs | Scheduled assessments with scope reviewed for each cycle and tracking of previous findings |
A scan identifies potential weaknesses automatically. A pentest adds manual investigation to validate exploitability, test business logic and explain the impact of confirmed findings.
The environment and permitted techniques are agreed during scoping. Production testing requires specific authorization, testing windows, operational limits and a contact who can pause the work.
We can test with no credentials, with test accounts or with additional technical information, depending on the objective. Source code is not required for every pentest; an in-depth code review can be scoped separately.
A pentest assesses the agreed scope within a defined period. It cannot guarantee the absence of vulnerabilities or replace ongoing security practices. The report records the coverage and limitations so you can use the findings in context.
We reply with a few questions about scope, then send a proposal with dates and price.