Offensive, 8 services
Manual, senior-led penetration testing aligned to PTES, OWASP and NIST SP 800-115, reported so your own engineers can close every finding. Eight services, one method, one point of contact from scoping to retest.
Services
External penetration testing of your internet-facing perimeter: exposed services, VPN, mail and DNS, tested by hand by a senior consultant.
You receive Findings for every exposed service, each with evidence and a fix, and a debrief call on the priorities
Internal penetration testing from a foothold on your network: Active Directory attack paths, credential hygiene and segmentation, tested to domain admin.
You receive The attack path drawn out from foothold to domain admin, step by step, with a fix for each link
Web application penetration testing against the OWASP Testing Guide: authentication, access control, injection and business logic, tested by hand.
You receive Findings with evidence and reproduction steps, and a debrief with your development team
API penetration testing for REST, GraphQL and SOAP against the OWASP API Security Top 10: authorisation, rate limiting and undocumented endpoints.
You receive An inventory of every endpoint tested, undocumented ones included, with the request that reproduces each finding
Mobile application penetration testing for iOS and Android against OWASP MASVS: local storage, transport security, reverse engineering and the API.
You receive One report covering the app and the API it depends on, with evidence from the device
Wireless penetration testing of corporate and guest Wi-Fi: WPA2 and WPA3-Enterprise, rogue access points, guest isolation and signal leakage.
You receive A signal survey of where your networks reach beyond your walls, with findings ranked by risk
Cloud security assessment for AWS, Azure, Microsoft 365 and Google Cloud: CIS Benchmark review and attack-path testing of identity, exposure and logging.
You receive The identity attack paths drawn out, from ordinary account to tenancy control, mapped to the CIS Benchmark
Phishing simulation and social engineering assessment: measured, consented email and voice campaigns that show your awareness baseline and process gaps.
You receive Aggregate results, the reporting rate above all, and the process gaps behind them. Nothing that names individuals
The Aurian engagement lifecycle
Every penetration test follows the same four phases, so you know what happens next before we start.
We agree what is in and out, the test windows, the credentials and contacts, and the rules of engagement, in writing.
A senior consultant tests by hand, using automated tooling for coverage. You hear about serious findings the day we confirm them.
An executive summary for the board and the insurer, and technical findings with evidence and a fix your engineers can apply.
Once you have remediated, we retest and update the report so the record shows what was found and what was closed.
Coverage
Each penetration testing service covers part of a typical organisation. Together they cover the whole path an attacker would take, from the internet to your customer data. Hover or tab to a system to see which services test it.
A penetration test is an authorised, manual attempt to break into a defined set of systems the way an attacker would, followed by a report that shows what was reached, how, and what to change. Aurian's consultants use automated tools for coverage, but the test is the consultant's work: chaining weaknesses together, testing logic, and judging what matters in your environment.
A vulnerability scan is automated. It lists known weaknesses by signature and stops there. A penetration test starts where the scan stops: a consultant confirms what is real, chains weaknesses into a path, and shows what an attacker could actually reach. Aurian offers both; scanning sits inside our managed vulnerability management service, and testing is the work described on these pages.
At least once a year, and after significant change: a new customer-facing application, a migration to the cloud, a merger, or a new remote-access arrangement. An annual test with continuous scanning in between is a common arrangement, and cyber insurers increasingly expect it.
Each engagement is priced from its scope: the number of hosts, applications or users in play and the depth of testing required. Every engagement is a fixed price agreed after scoping, so the cost is known before any testing starts.
Testing is planned with you before it starts: what is in scope, when we test, and who to call. Denial-of-service testing is out of scope unless you ask for it. When a test could affect a production system, we agree a window and a rollback plan in writing, and we test the fragile parts when you say so.
It depends on the test. External network tests start without any. Web application, API and internal tests find more when they include an authenticated phase, because that is where most real attacks operate. We ask for test accounts at scoping and tell you exactly what each one will be used for.
Also from Aurian: security assurance and compliance services, and managed security services.
Tell us what you need to know about your environment. We reply within one business day.