How an audit works
A useful pentest means a clear scope, testing with no nasty surprises for production, and a report your team can act on. Here is how a typical engagement runs.
Steps
- 1
Scoping call
30 minutes to understand your context: what needs protecting, why now (customer, NIS2, certification…), and what is in scope. You then receive a quote.
- 2
Rules of engagement
A signed document setting the exact scope, dates, testing IP addresses, excluded actions and emergency contacts. It protects both sides: no written authorisation, no testing.
- 3
Testing
The technical phase, 1 to 10 days depending on scope. A critical vulnerability is reported immediately, without waiting for the report.
- 4
Report
Delivered as a PDF, in French or English. See its structure below.
- 5
Debrief
A meeting with your team to present findings, answer questions and prioritise fixes.
- 6
Retest
Once fixes are in, I check they work and update the report. Useful to prove remediation to a customer or auditor.
What the report contains
- Executive summary
- Two pages readable without a technical background: overall risk, critical issues, priorities.
- Scope and conditions
- What was tested, when, from where, with which access.
- One entry per vulnerability
- Description, proof (screenshots, requests), CVSS score, concrete business impact, recommended fix tailored to your stack.
- Remediation plan
- Fixes ranked by priority and effort.
Sample vulnerability entry
Fictional example written to illustrate the format. No real customer.
- Finding
- The invoice download API checks that the user is logged in, but not that the requested invoice belongs to their company.
- Impact
- Any logged-in customer can read other customers’ invoices: names, addresses, amounts. A personal data breach under GDPR.
- Proof
- Requests and screenshots in the appendix, using two test accounts provided for the audit.
- Fix
- Check server-side, on every request, that the invoice belongs to the user’s organisation. Add an automated test for this check.
Standards
- OWASP Web Security Testing Guide : for web applications and APIs.
- PTES (Penetration Testing Execution Standard) : for the overall engagement flow.
- CVSS : to rate each vulnerability’s severity in a standard way and prioritise fixes.
- ANSSI recommendations and CIS Benchmarks : for Active Directory and cloud.
And during testing?
You have a single point of contact, reachable throughout. Testing follows the agreed time windows. If anything unexpected happens, I stop and call you.
Planning a security audit?
Estimate your audit online in 2 minutes, or book a call. You leave with a duration and price range, no strings attached.
Get a quote