Pentest & attack simulation Penetration testing (pentest): simulate a real cyberattack on your systems

A pentest is an offensive security test performed within an authorised framework. It follows an attacker-like logic to check whether vulnerabilities on an application, network or infrastructure can actually be exploited. See the definition.

Pentest is short for penetration testing. It is the same service. See the definition.

There is no fundamental difference: pentest is the English abbreviation of penetration testing. Both names refer to the same engagement. See the definition.

A cybersecurity audit gives a global view of the IT landscape: architecture, configuration, processes and governance. A pentest is a targeted offensive test, on a defined scope, to assess whether vulnerabilities are exploitable. An audit may come before a pentest; they are not the same service. See the comparison.

A scan mainly detects potential weaknesses, often automatically. A pentest seeks to determine what is actually exploitable and what the impact would be. A scan is not a substitute for a pentest. See the comparison.

An external pentest assesses your Internet-facing surface: what an attacker can reach without prior access to your internal network, including exposed services, remote access, VPN and public interfaces. See external pentest.

An internal pentest simulates an attacker already present on the network. It assesses segmentation, privileges, accounts and possible movement between environments. See internal pentest.

A web pentest, or web application pentest, covers your applications and interfaces: authentication, sessions, authorisation, user input, application logic and APIs. Testing is built around the main application risk families recognised by OWASP. See web pentest.

In a black box pentest, the tester has very little initial information. The approach is close to an external attacker scenario. See test approaches.

Black box: little initial information. Grey box: some information or access is provided to go deeper. White box: the tester has more complete technical information. The mode is chosen according to the objective, budget and desired depth. See test approaches.

This is decided according to the scope and rules of engagement. Neither a systematic yes nor a systematic no: scoping sets the environment, the testing window and authorised actions. No test starts without explicit validation. See the authorised framework.

The price of a pentest depends primarily on the scope to be tested, not solely on the size of the company. As a guide: application pentest €2,900–5,500 excl. VAT, infrastructure pentest €3,900–7,500 excl. VAT, full pentest €6,500–12,000 excl. VAT. See pricing.

The price of a penetration test is the price of a pentest: it is the same service. It is calculated from the scope (applications, APIs, IPs, test type, retest), with indicative ranges from €2,900 to €12,000 excl. VAT depending on the pack. See the price factors.

There is no universal rule. A small scope takes a few days. A standard application or infrastructure takes about one to two weeks, depending on preparation and depth. A complex scope requires specific scheduling. Scoping and access to environments strongly determine the timeline. See indicative timelines.

A deliverable that leadership can read and IT can act on: an executive summary, vulnerability sheets and a remediation roadmap. See the report example.

A retest targets previously identified vulnerabilities to verify that the implemented fixes are effective. It is included in the full pentest; on the application and infrastructure offers, it is optional and billed separately. See the retest.

A pentest is a structured engagement with a defined scope, carried out by a commissioned team within a limited timeframe. A bug bounty is an ongoing programme open to a community of security researchers. Both can be complementary, but they do not meet exactly the same need. See the comparison.

Only within a framework that is explicitly authorised and defined with the organisation: authorised campaign, defined population and rules of engagement. See the phishing test.