Black/grey-box attack on product and perimeter. Real chains to money and accounts — not green scanner checkmarks.
Without a pentest you pay either for a scanner’s false calm or for an incident. A leak, a locked-out admin panel, someone inside your CRM or Mini App — that’s money and reputation. A pentest shows whether you can be reached and what to fix first.
In this engagement:
We lock RoE and scope first: what’s in play, what’s off-limits, who is on call during the test window. Critical findings go to chat immediately — we don’t wait for the final PDF. You get a prioritized report and a retest as agreed. Timeline depends on perimeter; scope and price are fixed after a short intake.
Typically from a few days to a few weeks — depends on scope: one product, admin panel, perimeter, integrations. From you: access per RoE, contacts for critical alerts, a no-go list. Exact timing is set after we review the perimeter, not a vague ballpark.
A scanner gives a list of possible issues and a lot of noise. A pentest checks whether that turns into a path to data, money, or system control — hands-on, with escalation and business context. You get what to fix first, not “a thousand mediums.”