Penetration Testing in South Africa

A penetration test is a controlled attack on your systems by people who do this for a living, with your permission and inside agreed rules. It answers one question a scanner cannot: what could a motivated attacker actually do to this business, starting from the outside, this month?

What we test

• Web applications and APIs. Manual testing aligned to the OWASP Web Security Testing Guide: authentication, authorisation, injection, business logic, session handling, and the things scanners never find because they need a human to understand what the application is for.
• External and internal network. What is exposed to the internet and what an attacker can reach once inside. Active Directory, privilege escalation, lateral movement, and whether your backups would survive the ransomware chain we keep seeing.
• Cloud and Microsoft 365. Tenancy configuration, identity and conditional access, mailbox rules, sharing, and the gaps between what the console says and what is actually enforced.
• People. Phishing simulation and social engineering, measured and reported without naming and shaming. The point is to find out what the training missed, not to embarrass anyone.
• Attack surface footprinting. Everything about the business that is visible from outside: forgotten subdomains, exposed services, leaked credentials, and whether your email domain can be forged.

How an engagement runs

1. Scoping call. Usually within one business day. We agree what is in scope, what is fragile, and what the business is most worried about. You get a fixed quote before anything starts.
2. Rules of engagement. A short signed document: targets, testing windows, emergency contacts, what we will not do. Testing typically begins one to two weeks later.
3. Testing. One to three weeks for most small and mid-sized businesses. We tell you the moment we find anything critical, not at the end.
4. Report and walkthrough. We present the findings to your technical team and, separately, to management. Every finding comes with reproduction steps and remediation a developer can act on.
5. Retest. Included. We verify each fix and reissue the report showing what was closed, plus a letter of attestation you can hand to clients, auditors or insurers.

What you get

Most penetration test reports are read once and filed. We measure ours by how many findings are fixed within 90 days. That means an executive summary that stands alone, severity that reflects business impact rather than a score, exact reproduction steps, and remediation written for your stack. Scoring follows CVSS with a plain-English impact line beside each rating. Methodology follows the OWASP testing guide, PTES and NIST SP 800-115.

Why South African businesses test

• POPIA. Section 19 requires "appropriate, reasonable technical and organisational measures", and the Information Regulator's enforcement record treats routine vulnerability testing with evidence of remediation as part of the floor. What the Regulator actually expects.
• Client and tender due diligence. Larger customers increasingly ask suppliers for a recent independent test before signing. The attestation letter answers that.
• Cyber insurance. Insurers ask for it at renewal, and premiums follow the answer.
• After an incident, or before a launch. To confirm the fix held, or to find out before customers do.

Pricing

Fixed price per engagement, quoted after the scoping call. We size tests to the business: a 20-person firm with one web application does not need, and should not pay for, an enterprise engagement. There is no published rate card because scope varies too much for one to be honest.

Questions