We attack your systems in a controlled way — adversary-simulated, not an automated scan dump — and show what a real attacker can actually reach. Afterwards you get a professional report you can act on.
Book a free scoping callWe call you back within one business day. We talk about what needs testing, why (NIS2, ISO 27001, a customer asking for it) and when.
Within 2 business days of the call you get the scope, a timeline and a fixed price. No hourly billing, no surprises.
We test in the agreed window, call you the same day about anything critical and deliver the report with the retest included.
Prefer e-mail to a call? Say so in the message and we will handle scope and quote in writing.
30 minutes, no obligation. We call you back within one business day.
A penetration test (pentest) is a controlled, authorised security test where we try to break into your systems the same way a real attacker would. The goal is to find the vulnerabilities — in applications, APIs, infrastructure and configuration — before anyone with bad intentions does. We test web applications, APIs, networks and WordPress, and deliver the evidence your auditor asks for under ISO 27001, NIS2 and PCI DSS.
Everything we do runs from one source: a database we have built over more than ten years of engagements, recording for every technology what to test, where it usually breaks and what is noise. Our specialists work from it, our AI agent tests from it, and our EdgeTester platform scans from it. That gives you human insight and machine endurance, aimed at your exact stack rather than a generic checklist.
Six steps, the same every time. At any point you know which one we are in.
A free 30-minute call. We agree what is in scope, what is off limits, the test window and who can stop the test. Within 2 business days you get a fixed quote in writing.
EdgeTester maps the attack surface: hosts, services, versions, endpoints and what the internet already knows about you. Our ten-year database tells it what to look for in your stack.
Experienced specialists and our AI agent try to get in. We chain weaknesses the way an attacker would: a leaked credential, plus a misconfigured service, plus a logic flaw.
Every finding is reproduced before it is written down. If we cannot reproduce it, it is not in the report.
A management summary on page one, technical findings with evidence and fixes behind it. Written by the person who found the problem.
When you have fixed the findings, we test them again and confirm in writing.
Every engagement is scoped to what you actually run. These are the areas we test most, each with its own method and checklist.
External (internet-facing) and internal, including Active Directory.
OWASP Top 10, authentication, access control and business logic.
REST and GraphQL: authentication, authorisation, input handling and rate limiting.
iOS and Android: local data storage, network traffic, reverse engineering and the backend APIs the app uses.
Core, plugins, themes, admin panel exposure, user enumeration and a hardening review.
SIP and PBX security, toll fraud, call interception and exposed management interfaces.
AWS, Azure and Microsoft 365 configuration review.
Chatbots, copilots and agents: prompt injection, data leaks and tool misuse.
A lighter scan-and-verify option for smaller environments and budgets.
We check that the fixes actually work after you remediate.
Different people need different things from a penetration test. The report is built so each of them can take their part and go.
One page. What we found, how bad it is, what to do first. For the person who signs off on the budget.
Every finding with severity, CVSS, evidence, steps to reproduce and a concrete fix. For the people who have to close the gaps.
Scope, method, dates and a tester statement, structured so your ISO 27001, NIS2 or PCI DSS auditor gets what they ask for.
A short, dated letter confirming which findings were verified closed. Send it to customers, partners or the board.
A penetration test is an attack. These are the rules that make it a safe one.
Systems, addresses, test window and exclusions are agreed before the first packet. Nothing outside it is touched.
We do not run denial-of-service, destroy data or change configurations. If an exploit could be disruptive, we ask first.
A critical finding reaches you the day we confirm it, with a workaround if we have one. You do not wait for the report to find out.
You name a contact, we name one. Either side can pause or halt the test at any time with a single message.
There are three ways to get a penetration test today. They are not the same thing. We use the first two ourselves, inside the third.
| Vulnerability scanner | Automated AI pentest | Edgetek | |
|---|---|---|---|
| Known vulnerabilities in exposed services | Yes | Yes | Yes |
| Common web flaws: injection, misconfiguration | Partly | Yes | Yes |
| Business logic and authorisation flaws | No | Partly | Yes |
| Chaining weak points into a real attack path | No | Partly | Yes |
| VoIP, Active Directory, mobile, cloud configuration | Partly | No | Yes |
| Every finding reproduced by a person | No | No | Yes |
| Report written by the tester for your decision-makers | No | No | Yes |
| Named people you can call afterwards | No | No | Yes |
| Results within hours | Yes | Yes | Days to two weeks |
EdgeTester, our own scanner, and our AI agent run in every test we do. The difference is what happens after they stop.
Have a question that isn't covered here? Email us at info@edgetek.dk
The price depends on the scope — number of systems, applications and attack surfaces. After a free 30-minute scoping call you get a fixed quote in writing within 2 business days. No hourly billing.
It is free, takes 30 minutes and commits you to nothing. We ask what needs testing (web application, API, network, cloud), why (NIS2, ISO 27001, a customer asking for it) and when. Within 2 business days of the call you get the scope, a timeline and a fixed quote in writing. If you say no thanks, there is no bill.
A typical test takes from a few days to a couple of weeks depending on scope. We agree on a timeline and rules of engagement before we start.
A vulnerability scan is automated and finds known weaknesses. A penetration test goes further: we exploit the weaknesses manually to show the real risk and attack path — not just a list of possible problems.
We can test in both production and test environments. We always agree on scope, timing and precautions in advance so operations aren't disrupted.
Yes. Every test ends with a professional report of prioritised findings, risk assessment, documentation and concrete recommendations — plus an offer of a retest.
Penetration testing is often required or strongly recommended under standards like ISO 27001, NIS2 and PCI DSS. We help you test and document it so you can demonstrate compliance to your auditor.
Typically at least once a year, plus after any major change to your systems or infrastructure. We advise on the right cadence for your risk profile.
We test web applications, APIs, mobile apps, networks, infrastructure and cloud setups. We agree the exact scope with you in advance.
Very little. We align on scope, access and timing with you — then we handle the rest. You don't need to tidy up your systems first; we want to see them as they really are.
AI pentest tools run many agents against a web application and report what they can find within hours. We use the same kind of automation ourselves: EdgeTester for reconnaissance and an AI agent as a tester alongside us. The difference is what happens next. Experienced testers chain the findings into real attack paths, test the targets automation handles poorly (VoIP, Active Directory, mobile, cloud configuration, business logic), reproduce every finding by hand and write the report. And you get people you can call afterwards.
You hear about it the same day, by phone or e-mail, with a workaround if we have one. We do not sit on critical findings until the report is finished.
Yes. A retest of all findings is included in every penetration test. We agree the retest window in the quote.
A free 30-minute call, and within 2 business days you get the scope, a timeline and a fixed quote in writing.
Book call