Technical & response
Penetration Testing
Simulate attacks to find weaknesses before hackers do. Testing begins only after written authority and a signed rules-of-engagement document — that discipline is precisely what makes aggressive testing safe to run against production.
Test types
What we test
Scoped individually or combined. Black-box, grey-box and white-box approaches are all available; the right one depends on what question you are trying to answer.
External network
Internet-facing infrastructure: exposure enumeration, service and version analysis, authentication surfaces, known-vulnerability exploitation and chained attack paths into the internal estate.
Internal network
Assumed-breach testing from a foothold on the internal network: credential harvesting, lateral movement, privilege escalation, directory services abuse and the path to domain or tenant compromise.
Web applications
Authenticated and unauthenticated testing across access control, injection, authentication and session handling, business-logic abuse, file handling and client-side exposures.
APIs
REST, GraphQL and service-to-service interfaces: broken object-level authorisation, mass assignment, rate limiting, token handling and the documentation drift that hides unlisted endpoints.
Cloud configuration
Identity and permission review, network exposure, storage access, key and secret management, logging coverage, and tenancy separation in AWS, Azure and Google Cloud estates.
Social engineering
Phishing and pretexting simulations conducted under strict ethical limits, with staff treated as a control to be measured rather than individuals to be caught out. Results are reported in aggregate.
Authorisation
Nothing happens without rules of engagement
Penetration testing may be performed only after you have provided written authority and an agreed rules-of-engagement document. That document is drafted jointly before any fee is quoted for test delivery.
The document records
- Authorised targets, by hostname, address range or account
- Explicitly excluded systems and prohibited techniques
- Test windows, rate limits and change-freeze awareness
- Named emergency contacts on both sides, available throughout
- Data-handling rules for anything recovered during testing
- Stop conditions and the escalation route for critical findings
Your warranties
You warrant that you own or are authorised to test every target, and that you have obtained all necessary permissions from hosting providers, cloud providers, telecommunications providers, customers and other third parties.
DataFort Solutions Ltd. will not knowingly test an unauthorised target. You must not ask us to exploit a third-party system or to conceal testing activity from a system owner.
Reporting
- Executive summary written for a non-technical reader
- Findings separated into exploited, exploitable and theoretical
- Reproduction steps, evidence and affected assets for each finding
- CVSS v3.1 base and environmental scoring, with context explaining the number
- Remediation guidance aimed at the root cause, not the symptom
- Attack-path narrative showing how individually minor issues combined
- Retest of remediated findings within the agreed window
Before testing begins
Testing can cause service disruption, alerts, data changes, account lockouts, performance degradation or other unintended effects even where reasonable precautions are taken.
- Verified, restorable backups of in-scope systems
- Monitoring and recovery capability available during the test window
- Internal approvals obtained, including from system owners
- Your security operations team briefed, or deliberately not briefed if the exercise is a detection test
- Third-party provider notifications sent where their terms require it
Limitations you should understand before engaging
Testing does not guarantee discovery of all vulnerabilities. A penetration test is a time-boxed exercise against an agreed scope using agreed techniques. It does not guarantee that every weakness has been identified, and it does not guarantee that a system will withstand a real attack by a motivated adversary with more time and fewer constraints.
You must maintain appropriate backups, monitoring, recovery capability and internal approvals before testing begins. Where a system proves more fragile than the scoping conversation indicated, we will invoke the agreed stop conditions and escalate rather than continue.
Nothing on this website grants permission to test any DataFort Solutions Ltd. system. If you believe you have found a vulnerability in our own infrastructure, please use our coordinated disclosure contact. The full position on testing is set out in sections 8 and 21 of our Terms of Service.
Penetration testing
Find it before someone less friendly does.
Tell us what you need tested and why. We will tell you honestly whether a test is the right instrument.