Penetration Testing in Hamilton & Burlington
With your written permission, we try to get into your website, network or Wi-Fi the way an attacker would, inside the limits we agree on. You get a plain-language report of what we found, how serious each finding is and what to fix first, and once it's fixed, we check again.
- Written permission first
- Nothing is tested until it's signed
- Tested by a person
- Not just an automated scan
- Tested when it suits you
- In the window you choose
- Fixes checked
- A second look once they're in
The ways in an attacker would try first
Websites and web apps
Logins, forms, payments and the server behind them, checked for common weaknesses such as those in the OWASP Top 10.
Your internet-facing network
The firewall, remote access, VPN and anything else reachable from the internet, seen the way an outsider sees it.
Wi-Fi
Guest and staff networks, how well they are kept apart, password strength, and look-alike access points.
Inside your office
What a visitor's laptop or one infected computer could reach on your network, and how far it could go from there.
Most tests cover one or two of these. We agree on the scope with you first, so you pay for what matters to you.
A report you can act on
A plain-language summary for owners, and for an insurer or client who asks.
Every finding with how we found it, how serious it is and how to fix it, biggest risks first.
Screenshots and steps, so whoever looks after your systems can see each problem and fix it.
A second look once the fixes are in, so you know they worked.
Permission, care, then a clear report
Scope
A free call to agree what we test, when, and what is off-limits.
Permission in writing
You sign an authorization naming the systems and the dates. Nothing is touched before that.
Testing
During the window you choose, carefully: nothing meant to slow systems down or knock them over, and we call you straight away about anything urgent.
Report and re-test
We walk you through what we found, then check the fixes once you have made them.
When a test is worth it
Someone asked for a pentest
An insurer, a client or a contract wants to see that you have been tested. We scope the test to what they are asking for.
Launching something new
A new website, online store or customer portal, tested before customers rely on it.
After a change or a scare
A new office network, a move to the cloud, or a close call you want to be sure is behind you.
Checking the basics hold up
You have done the obvious things and want an outside check of how well they work.
What to expect
What a test can and can’t tell you
A penetration test shows what we found within the scope and the time we agreed. It’s a snapshot, not a guarantee that nothing else exists, and the report says so. Many businesses test again after a big change, or once a year.
How pricing works
Every test is quoted after a free scoping call, for the scope we agree, so you know the cost before anything starts. Not ready for a full test? A risk assessment or a free BadgerScan of your website is a good place to start.
Our own research
We do our own security research and report what we find to software makers through their disclosure programs.
Local and accountable
A Hamilton and Burlington team you can meet, call, and hold to what we agreed in writing.
Help with the fixes
We also build and look after networks, Wi-Fi and websites, so we can help fix what the test turns up.
Penetration testing questions, answered
Is penetration testing legal?
Yes, with written permission from whoever owns the systems. Testing without it is an offence under the Criminal Code, so we never start without a signed authorization naming what we will test and when.
Will testing disrupt my business?
It should not. We test during the window you choose, avoid anything meant to slow systems down or knock them over, and stop and call you straight away if we find something urgent.
How is this different from BadgerScan or a risk assessment?
BadgerScan is a free, automated check of a website's public security settings. A risk assessment reviews how your business is set up against the NIST Cybersecurity Framework. A penetration test goes further: a person actively tries to get in, within the scope you agree to, and shows you how.
How long does it take?
It depends on what is in scope. A single website or a small office is usually a few days of testing, then the report. You will have the dates before you sign anything.
What about systems we do not own, like Microsoft 365 or our web host?
We can only test what you are allowed to authorize. Large cloud providers publish their own rules for testing and we follow them; if someone else hosts your site, we may need their okay as well.
What happens to our data?
We take only what we need to show a finding, and we agree with you up front how long we keep anything and how it is deleted.
Ready to see where you stand?
Book a free scoping call. We agree on what to test and when, put it in writing, and give you a clear quote before anything starts.