03 · Testing # Penetration Testing & Cybersecurity Testing Our engineers find and fix vulnerabilities before attackers do, for a strong defence against cyber threats. ## What’s included ### Penetration testing - Full-spectrum testing, from reconnaissance through exploitation to reporting, across web, client-server, infrastructure, mobile, wireless and social engineering. - Black-, grey- or white-box scopes, with commercial tools and custom scripts. - Reports covering each gap, its impact and how to fix it. ### Vulnerability assessments - Automated scanning plus manual discovery across software, hardware and systems. - Ongoing management to prioritise, patch and mitigate. ### Application security testing Threat modelling and testing of web and mobile apps, APIs, microservices and back ends for injection, XSS and broken authentication. - OWASP Top 10 - STRIDE - DREAD - OpenSAMM - OSSTMM - WASC ### Social engineering testing - Phishing, baiting and pretexting campaigns. - Click-rate metrics and targeted follow-up training. ### Red team operations - Full-scope adversary simulations that test detection and response. - Defences assessed against advanced persistent threats. ### Compliance testing - Testing that verifies compliance with regulations such as NCA and SAMA. - Gap analysis and reporting that demonstrate adherence. ## Types of penetration testing - **Web applications:** Websites, portals and web apps tested against the OWASP Top 10 and the OWASP Web Security Testing Guide: access control, injection, cross-site scripting, authentication, session handling and business logic. - **Mobile applications:** iOS and Android apps tested against OWASP MASVS: data storage, encryption, certificate pinning, reverse engineering and the APIs behind the app. - **APIs:** REST, SOAP and GraphQL tested against the OWASP API Security Top 10, including broken object-level authorisation and missing rate limits. Important for open banking. - **External network:** Internet-facing firewalls, VPNs, mail servers and exposed services, from an outside attacker’s point of view. - **Internal network:** An attacker who is already inside: Active Directory, privilege escalation, lateral movement and segmentation. - **Cloud:** AWS, Azure, Google Cloud and Saudi cloud platforms: storage, IAM roles, exposed keys and containers. - **Wireless:** Wi-Fi encryption, guest isolation and rogue access points. - **Red teaming:** A longer, goal-based simulation that tests people, process and technology together, with every action mapped to MITRE ATT&CK. ## Black, grey or white box | Approach | What the tester knows | Best for | | --- | --- | --- | | Black box | Nothing beyond the target | Realistic view of an anonymous outside attacker | | Grey box | A normal user account or limited information | Best balance of realism and coverage | | White box | Architecture, source code and credentials | The deepest review, before launch or after major changes | ## Our methodology We follow PTES, the OWASP testing guides, NIST SP 800-115 and OSSTMM. Written authorisation is signed before any testing starts. 1. **Scoping**: Targets, testing windows, rules of engagement and emergency contacts. 2. **Reconnaissance**: Subdomains, technologies and exposed services. 3. **Threat modelling**: The most valuable targets and likely attack paths. 4. **Vulnerability analysis**: Automated scanning combined with manual review. 5. **Exploitation**: Safely proving which weaknesses can be used, without damaging data or services. 6. **Post-exploitation**: How far an attacker could go, such as sensitive data or domain admin. 7. **Reporting**: Executive and technical reports. 8. **Retesting**: We help your team fix issues and confirm they are closed. ## What your report includes - An executive summary in plain language, with overall risk and business impact - Each finding with its CVSS score, affected assets, reproduction steps and evidence - Remediation guidance written for developers and administrators - Mapping to NCA ECC, SAMA CSF, PCI DSS and ISO 27001 controls - A retest report you can show auditors and clients ## What drives the cost of a penetration test Price depends on effort: the number of applications, pages and API endpoints, the number of user roles, the number of IP addresses, the testing approach, the depth required and whether retesting is included. A single web application costs far less than a red team exercise. We give a fixed quote after a short scoping call. ## Why CYBRT ### Riyadh-based, Gulf-focused Headquartered in Riyadh, working with organisations across Saudi Arabia and the Gulf. ### Certified consultants Our team holds CISA, CISM, CRISC, CGEIT, CDPSE, CCSP, CCSK, COBIT and ISO 27001 Lead Auditor certifications, among others. ### Regulation-ready We work with NCA and SAMA frameworks alongside ISO, NIST and PCI-DSS, so controls map straight to what auditors expect. ### End to end Six connected services, from strategy and awareness through testing, operations, cloud and technology. ## Frequently asked questions ### What can you penetration test? Web applications, client-server applications, infrastructure, mobile, wireless and people through social engineering, in black-, grey- or white-box engagements. ### How is a vulnerability assessment different from a penetration test? A vulnerability assessment finds and prioritises weaknesses through scanning and manual review. A penetration test goes further and exploits them to show real-world impact, then reports how to fix each one. ### Do you test against NCA and SAMA requirements? Yes. Our compliance testing verifies adherence to regulations such as NCA and SAMA, with gap analysis and reporting you can share with auditors. ### How often should we run a penetration test? At least once a year, and after any major change such as a new application, a cloud migration, a large upgrade or a merger. PCI DSS requires internal and external tests at least annually and after significant changes. ### Will testing affect our live systems? We plan carefully to avoid disruption. Higher-risk actions are agreed in advance, and testing can run outside business hours or in a staging environment. ### How long does a penetration test take? A single web application usually takes five to ten working days. Network tests depend on size, and red team exercises can run for several weeks. ### What do we need to prepare? A list of targets, test accounts for grey-box testing, a technical contact and approval from the system owners. ## Related services ## Ready to protect your business? Book your free security consultation today. --- Canonical page: https://cybrt.sa/services/penetration-testing/ Guide for AI agents: https://cybrt.sa/llms.txt