Trust Center Sign in
Endpoint modulesNGAV / Malware PreventionFirewall & Firewall PolicyApp ControlDevice ControlDLPFileHunt & QuarantineFile Integrity MonitoringHost InventorySoftware Inventory / SBOMPatch ManagementExposure ManagementExposure ControlEncryption PostureIdentity & ITDRSession AssuranceZTNA PostureThreat IntelligenceCustom DetectionsObservabilitySIEM ForwardingBrowser & IDE SecurityComplianceEndpoint EffectorsIR ShellAutonomic RemediationAnalyst Workflows
OffensivePenetration TestingRed TeamingAI Red TeamingAdversary SimulationVulnerability AssessmentsApplication Security AssessmentsDetectionManaged Detection & ResponseThreat HuntingIncident Response RetainersIncident Readiness & ResponseDetection EngineeringPreparednessTabletop ExercisesRansomware Readiness AssessmentsIncident Response Plan Development and TestingSecure Software Development AssessmentArchitectureSecurity Program DesignSecurity Maturity AssessmentsZero Trust AssessmentsCloud Security Architecture ReviewsRiskSupply Chain Risk ManagementSoftware Supply Chain SecurityQuantum Readiness AssessmentsData Security Assessments
Architecture LibraryWhitepapersPerspectivesAnalyst & Investor BriefingsGlossaryEvents
Company overviewVisionCode of EthicsLeadershipCareersNews & PressContact
Worldwide (EN) United Kingdom Australia Singapore India France Deutschland Brasil Latinoamérica 日本 대한민국
Sign inContact us
Human-led security service

Penetration Testing

Evaluate whether agreed internet-facing or internal defenses resist bounded testing.

Scope a penetration test →
What we evaluate

Scope the decision before testing the control.

Evaluate whether agreed internet-facing or internal defenses resist bounded testing. Scope, access, evidence sources, and safety conditions are agreed before work begins.

01

Authorize

Confirm objectives, owners, scope, access, and stop conditions in writing.

02

Evaluate

Gather and test evidence using practices appropriate to the agreed environment.

03

Validate

Review observations, uncertainty, business context, and practical remediation priorities.

04

Brief

Deliver decision-ready findings, owners, dependencies, and recommended next actions.

What you receive

Evidence your team can act on.

Deliverable

Written rules of engagement

Documented for decision-making, ownership, and follow-through.

Deliverable

verified observations

Documented for decision-making, ownership, and follow-through.

Deliverable

risk-ranked findings

Documented for decision-making, ownership, and follow-through.

Deliverable

retest option

Documented for decision-making, ownership, and follow-through.

Standards-informed approach

Recognized practices, applied to the engagement.

References guide the method and evidence boundary. They do not make this engagement an accredited audit, certification, legal opinion, or formal PCI validation.

Reference

NIST SP 800-115

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Reference

OWASP WSTG and ASVS

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Reference

PCI DSS 11.4 when CDE-scoped

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Reference

ISO/IEC 27001 and 27002

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Customer-authorized by design

Start with the outcome and scope.

Our services are human-led, customer-authorized engagements. The Spacetime platform remains purely defensive.

Scope a penetration test →