Penetration testing for businesses: find your vulnerabilities before attackers do

A proper penetration test isn't an automated scan. It's an expert who thinks like an attacker, looks for the least expected path and shows you exactly how far someone with bad intentions could get.

Scope your project · Request a security assessment

Rather talk it through? Call us at +34 960 730 013

3–10 days — of technical testing, depending on scope
24–48 h — to receive a fixed-price proposal
PoC + CVSS — for every finding, reproducible by your team
Retest — to confirm the fixes actually work

Is your company secure, or does it just think it is?

Many of the companies that suffer a serious cyberattack thought their systems were up to date. Firewalls, antivirus and patches aren't enough if there are vulnerabilities in your web application, in your internal network configuration or in the way your employees manage credentials. Penetration testing simulates what a real attacker would do: it searches, exploits and shows you the path before someone with bad intentions finds it first.

How an attacker turns three “medium” flaws into a critical breach

A scanner lists vulnerabilities one by one and scores each in isolation. An attacker chains them. This is the kind of path a manual pentest reproduces and no automated report will show you.

Forgotten subdomain (Reconnaissance): An exposed staging environment with directory listing enabled reveals the application's structure.
Default credentials (Initial access): The pre-production panel still has the installation user. First foothold.
IDOR in the API (Discovery): Changing an identifier in the request exposes other customers' orders and data.
Exposed service token (Escalation): A reachable configuration file contains a token with an administrator role.
Customer data export (Impact): With that role, the export feature hands over the entire customer database.

Real impact: No single piece looked urgent. Together they end in a GDPR breach notification. A pentest proves the whole chain; a scan only lists the pieces.

Illustrative example built from patterns we commonly see in our tests; it does not describe any specific client.

Which type of penetration test covers each part of your attack surface

Each layer of your company is tested differently. Pick a zone on the radar to see what we review there and the kind of flaw we find most often.

Web application pentesting (Internet-facing): Authentication, sessions, role-based access control, injections and business logic in applications, portals and e-commerce, following the OWASP WSTG. Typical finding: A regular user reaches admin functions or data by changing a path or a parameter.
API penetration testing (Internet-facing): Object- and function-level authorization, JWT and OAuth tokens, data exposure and usage limits in REST and GraphQL. Typical finding: BOLA: changing an order or customer identifier returns someone else's data.
Mobile application pentesting (Internet-facing): Local storage, communications, binary protection and the API behind the iOS or Android app, following OWASP MASVS. Typical finding: Keys or tokens stored in clear text on the device, and backend endpoints without the protection the app takes for granted.
AI penetration testing (Internet-facing): Direct and indirect prompt injection, jailbreaks, data leakage and tool abuse in chatbots and agents, following the OWASP Top 10 for LLM. Typical finding: A tampered document or web page makes the assistant reveal internal data or take actions it should not.
CMS penetration testing (Internet-facing): Core, plugins, themes, configuration and admin panels of WordPress, Magento, Drupal or PrestaShop. Typical finding: An outdated plugin with a public vulnerability that allows code execution or creating an administrator.
Cloud penetration testing (Infrastructure): IAM identities and permissions, exposed storage, networks and managed services in AWS, Azure and Google Cloud. Typical finding: An over-privileged role that allows escalating to control of the account.
Network and infrastructure pentesting (Infrastructure): Perimeter and internal network: exposed services, VPNs, segmentation, legacy protocols and server configuration. Typical finding: Management services reachable from where they should not be, with no segmentation between networks.
Active Directory pentesting (Internal network): Privileges, delegations, GPOs, service accounts and attack paths to domain control. Typical finding: A service account with a weak password (Kerberoasting) that opens the way to domain admin.

What type of pentesting do I need?

Web pentesting: applications, customer portals, e-commerce, APIs
Internal and perimeter network pentesting: exposed IPs, VPNs, firewalls
Active Directory pentesting: review of privileges, GPOs and lateral movement
API pentesting: REST, GraphQL, OAuth/OIDC
Mobile application pentesting: iOS and Android
Cloud pentesting: AWS, Azure and Google Cloud
CMS pentesting: WordPress, Magento, Drupal and PrestaShop
AI and LLM systems pentesting: prompt injection, jailbreaks and model data leakage
Red teaming: advanced, persistent attack simulation

How we run a penetration test

Reconnaissance: We gather information about your infrastructure, domains, technologies and possible attack vectors without direct access to your systems.
Enumeration: We identify active services, software versions, entry points and possible exposed credentials.
Controlled exploitation: We attack the vulnerabilities found in a controlled way to confirm their real impact and how far an attacker could get.
Post-exploitation: We assess what can be done once inside: privilege escalation, access to sensitive data, lateral movement.
Report and remediation: We document every finding with evidence, classify it by severity and give concrete instructions to fix it.

What you get when we finish

Executive report: risk in business terms, for management and the CISO
Technical report: vulnerabilities with PoC, CVSS and step-by-step recommendations
Closing meeting to explain the findings to the technical team
Availability to answer questions during remediation
Optional retest to verify that critical issues have been fixed

When should you hire a penetration test?

Before launching a web or mobile application to production
After a merger or acquisition (cybersecurity due diligence)
When an enterprise client or external auditor requires it
After implementing major infrastructure changes
To comply with NIS2, DORA, PCI-DSS or other regulations
If it's been more than a year since your last penetration test

Vulnerability assessment, pentest or Red Team: what do you need?

They are three different services answering three different questions. Picking the right one is the best way to avoid overpaying or falling short.

	Vulnerability assessment	Penetration test	Red Team
What it answers	Which known flaws do I have exposed?	What can an attacker exploit in this system, and with what impact?	Would our defensive team detect a real attack?
How it is done	Automated scanning, no exploitation	An expert exploits and chains flaws in a controlled way	A covert, multi-vector campaign against a business objective
Scope	Broad and shallow	Bounded: a website, an API, a network, a cloud environment	The whole organization: technical, human and, if agreed, physical
Typical duration	Hours or a few days	3–10 business days	Several weeks
Defensive team	Aware	Usually informed	Not informed
Indicative price	The lowest of the three	€2,000–€12,000 depending on scope	From €12,000
When to choose it	As a recurring control between tests	Before a launch, for a client or a regulation	When pentesting is mature and there is a SOC to validate

Compare with

Frequently asked questions about pentesting

When does it make sense to hire a penetration test?

When you need to validate real risk with evidence rather than a theoretical or purely automated assessment: before a launch, after a significant architecture change, when a client or regulation demands it, or when a vulnerability scan has flagged issues nobody has confirmed by exploiting them. If your goal is a compliance tick-box rather than finding out what an attacker could actually do, a pentest is the wrong purchase.

What should I ask a provider before hiring a pentest?

Four things settle most decisions: the CV and certifications of the people who will run the test, not just the company brand; a real anonymized sample report, to check whether they explain business impact or only dump technical findings; the methodology they follow (OWASP WSTG, PTES, OSSTMM); and whether a retest of the fixes is included. A provider that cannot show a sample report or names no methodology is usually selling an automated scan.

How much does a penetration test cost in Spain?

The price depends on the scope: number of IPs, URLs, applications and depth of the analysis. A standard-sized web pentest usually costs between €2,500 and €6,000; an API, between €2,000 and €6,000; and an internal or perimeter network, between €4,000 and €12,000. A red team engagement starts at €12,000. You can get an instant estimate with our pentest cost calculator, and we always start with a free first call to tailor the proposal to your case.

Can pentesting affect the availability of my systems?

We define the scope precisely before starting. By default, we avoid actions that could interrupt the service (DoS, data deletion). If any test carries potential risk, we agree it with you and run it during a maintenance window.

What's the difference between a pentest and a vulnerability assessment?

A vulnerability assessment is an automated scan that detects possible flaws but doesn't verify or exploit them. A pentest goes further: a human expert confirms the vulnerability is exploitable, demonstrates its real impact and assesses whether it allows escalating the attack. The result is far more actionable.

What's the difference between a pentest and ethical hacking?

A penetration test is a technical test scoped to one specific system or surface: a web app, an API, a network. Ethical hacking is a broader assessment that combines multiple vectors — OSINT, external perimeter, internal network, privilege escalation — to simulate a full attack campaign against your organization. If you need to assess a specific system, choose penetration testing; if you want to know how far a real attacker would get across your whole organization, choose ethical hacking.

What information do you need to start?

It depends on the type of test. For a black-box pentest, we only need the URLs or IPs in scope. For a gray-box or white-box test, we may need test credentials, source code access or architecture documentation. We agree everything before starting.

How long does a pentest take?

Between 3 and 10 business days for the technical phase, depending on the scope. The report is usually delivered 2-3 days later. For red team engagements or complex infrastructures, it can take longer.

How do I hire a penetration test for my company?

The process is simple: you describe your environment (URLs, IPs, applications or internal network in scope), we hold a free initial call to understand your needs, and within 24-48 hours you receive a proposal with scope, methodology and price. No fine print, no charges for the initial analysis.

Do you run penetration tests on artificial intelligence systems?

Yes, and it's worth separating two things that often get confused. One is auditing your AI: testing your models, chatbots and LLM agents against prompt injection, jailbreak, context poisoning and model data leakage, following the OWASP Top 10 for LLM and MITRE ATLAS — that's our AI penetration testing service. The other is using AI as a tool to speed up a conventional pentest, which is what AI-powered penetration testing covers. If your company has put a conversational assistant into production, the first one is what you need.

Specialised services

Before you hire

How it works

Regulation and context

Sources

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Request a security assessment