Penetration Testing Methodology and Safety Practices
Our approach is based on NIST SP800-115 with explicit modifications to reduce risk to production systems. We balance breadth (configured automation) and depth (manual testing) and stop once a fault is proven and documented. Web application testing covers the full OWASP Testing Guide, not only the Top 10. See also types of testing, cost guidance, and PTaaS.
Who Performs the Testing?
All work is performed by U.S.-based direct employees who hold industry certifications (GPEN, GWAPT, CEH, GSEC, CISSP, and others) and have strong development or networking backgrounds. Background checks are required. We do not use contractors or offshore resources.
Safety & Stability Focus
Risk reduction is built into the methodology and enforced by internal policy. We allow departure only when specifically authorized by the client. Key practices include:
- Pre-engagement interviews to identify shared resources, batch jobs, and third-party impacts.
- Customized scanner configurations (no DoS, unsafe memory corruption, or high thread counts).
- Canary scans on non-production hosts that mirror production when available.
- Manual review of applications before any automation; testers trained to recognize and pause on risky conditions.
- Benign, non-self-propagating payloads for electronic social engineering.
Network Methodology (high level)
Whois verification → canary scans → multi-configuration port scans (Nmap with customizations) → vulnerability scanning (Greenbone, customized) → data correlation (custom scripts) → manual validation, IPS evasion checks, anomaly review, and evidence collection.
Primary tools: Nmap, Greenbone, on-prem AI, custom Python and Perl scripts.
Web Application Methodology (high level)
Proxy-based manual review (ZAP with custom plugins) → confirmation of scope and safety → manual intrusive testing → automated scanning against captured targets → validation and deeper manual testing of findings and suspicions. Full OWASP Testing Guide coverage.
Primary tools: modern browsers, Zed Attack Proxy (ZAP), custom Python and Perl scripts.
Wireless Methodology (high level)
Passive reconnaissance and custom wordlist generation → discovery with aircrack-ng suite and Alfa adapters → checks for weak protocols, credentials, association attacks, and client issues → targeted manual testing.
Compliance Alignment
Engagements can be scoped and reported to support PCI-DSS, HIPAA, SOC 2, NIST, and New York 23 NYCRR 500 requirements. Sample reports are available on request.
Detailed methodology documents from the original site (network, web application, wireless, and safety pages) can be expanded here or linked as needed.