Penetration Testing (Pentest) for Businesses

A penetration test (pentest) is an authorised, simulated cyber attack on a company’s IT infrastructure to uncover real vulnerabilities before actual attackers exploit them. An automated vulnerability scan lists known weaknesses based on signatures without actively exploiting them. A penetration test goes further: ethical hackers combine multiple vulnerabilities into an attack path, test security measures under real conditions and deliver concrete attack demos as proof. For NIS2 and ISO 27001, a pentest is often mandatory and a scan alone is insufficient.

There are four main types. Network pentest checks external and internal network infrastructure for vulnerabilities in firewalls, switches and servers. Web application pentest analyses web applications for OWASP Top 10 vulnerabilities such as SQL injection, cross-site scripting and authentication flaws. Cloud security assessment checks cloud configurations on AWS, Azure or Google Cloud for misconfigurations and access risks. Social engineering test simulates phishing attacks and checks how many employees fall for fake emails. SAVECALL recommends the right pentest type based on your risk profile

A penetration test is necessary before launching new critical applications or IT systems, after major infrastructure changes such as cloud migration or SD-WAN rollout, to meet compliance requirements under NIS2, ISO 27001, GDPR or TISAX, after a security incident for root cause analysis, and as a regular security review (recommended annually or semi-annually). Companies that have never had a pentest typically have critical vulnerabilities they are unaware of. Ignorance does not protect against liability under NIS2.

Costs depend on scope, depth and test target. A network pentest for a mid-sized company with up to 50 systems costs 3,000 to 8,000 euros. A web application pentest for a complex application ranges from 4,000 to 12,000 euros. A comprehensive red team assessment with social engineering, physical access and multi-day attack scenario costs 15,000 to 40,000 euros. Annual vulnerability assessments as a more affordable complement start at 1,500 euros. SAVECALL coordinates certified pentest partners (OSCP, CREST) and manages the entire procurement process.

A professional penetration test follows five phases. Scoping and engagement (1 to 2 weeks): definition of targets, test scope, time window and legal authorisation by the client. Reconnaissance (passive and active): information gathering about the target system without direct attack. Exploitation: active exploitation of found vulnerabilities under controlled conditions. Post-exploitation: testing how far an attacker can advance after initial access. Reporting: detailed report with executive summary, technical findings by criticality and concrete recommendations. SAVECALL supports from scoping through to remediation of findings.

After the pentest you receive a detailed report with all findings prioritised by criticality (critical, high, medium, low), proof screenshots or exploit demos, CVSS scores and concrete remediation recommendations per vulnerability. SAVECALL supports prioritisation and coordinates remediation with your IT teams or service providers. After remediation, we recommend a retest that specifically re-checks the fixed vulnerabilities. For compliance documentation (NIS2, ISO 27001), we provide pentest-compliant reporting.