Penetration testing for SMEs in Bastia and Corsica
Penetration testing, or pentesting, is a simulated attack carried out with your written authorisation to uncover the vulnerabilities in your website, application or internet-facing services that could really be exploited. We run these tests from Bastia for SMEs, startups and public bodies, within a scope agreed in advance, then explain in plain terms what to fix and in what order.
What is a penetration test?
A pentest means stepping into an attacker's shoes, but with your consent and under strict rules. The aim is not to produce a theoretical list of weaknesses: it is to find out which ones can actually be exploited, and what that would mean for your business.
It goes well beyond an automated scan. A scanning tool spots software versions known to be vulnerable, often listed under a CVE identifier, the public reference number given to a known flaw. In a penetration test, a person also analyses how your application behaves, connects the findings and weeds out false alarms.
Depending on how much information you share, tests are described as black box (we start from nothing, like an outside attacker), grey box (we are given a user account) or white box (we have access to documentation and possibly the source code).
Website penetration testing: when should you plan it?
- 01
Before going live
A new online shop, customer portal or mobile app: testing before launch lets you fix issues calmly, with no real data at stake.
- 02
After a major change
A new payment module, user accounts or a change of hosting: every change can open a gap that earlier tests did not cover.
- 03
When a client or partner asks
Large customers, public-sector buyers and insurers increasingly ask about the security of your tools. A recent test report gives you concrete answers.
- 04
When you handle sensitive data
Health information, identity documents, bank details or residents' records: the more serious a leak would be, the more it pays to check your defences.
Pentest for SMEs: examples by sector
- 01
E-commerce
Checkout, discount codes, customer accounts and payment: we check that one customer cannot see another's orders or change a price.
- 02
Tourism and hospitality
Booking engines, contact forms and admin interfaces, often installed by different providers and worth checking before the season starts.
- 03
Professional and healthcare practices
Appointment portals and document sharing, where confidentiality is a professional duty.
- 04
Startups and software publishers
Online platforms and APIs, the access points your applications use to exchange data.
- 05
Local authorities and public bodies
Online service portals and forms that collect personal information about residents.
How an authorised penetration test unfolds
No test begins without prior written authorisation, signed by someone with the authority to give it, and rules of engagement agreed together.
- 01
Understand and scope
We discuss your business, your tools and your concerns, then define the exact scope, the exclusions, the type of test and the permitted time windows.
- 02
Prepare
You check your backups, provide the agreed test accounts and notify your hosting provider if their terms require it. An emergency contact is named on each side.
- 03
Test
We run the tests within the agreed scope and schedule, following public methods such as the OWASP testing guide. If a critical flaw emerges, we alert you straight away rather than waiting for the report.
- 04
Report back
We hand over the report and walk you through it, by video call or on your premises in Haute-Corse, so that every point is clearly understood.
- 05
Verify
Once you have made the fixes, a retest confirms that the reported vulnerabilities are closed.
The penetration test report and what happens next
The report is written for two audiences. A plain-English summary for management sets out the overall level of risk and the priorities. The detailed section, for whoever will make the fixes, describes each vulnerability, its severity, the evidence for it and the recommended fix.
The report belongs to you and we do not circulate it. Any data viewed during testing is deleted at the end of the engagement, as set out in the rules of engagement.
Afterwards, you can make the fixes with your usual provider or hand the remediation to us. A new test is worthwhile after each significant change to your website or application, rather than on a fixed calendar.
What to check before you commission a pentest
- 01
Who signs the authorisation
The person authorising the test must have the power to do so for every system in scope. A site hosted by a third party, or an online service, may need its provider's consent.
- 02
A realistic scope
Testing the essentials thoroughly beats skimming everything. The scope should reflect your real risks, not just what is easy to test.
- 03
Live or test environment
Testing on a staging environment avoids any effect on your customers; testing the live system reflects reality. We decide together, with the trade-offs in view.
- 04
A usable report
Ask to see how the report is structured: a raw dump of automated tool output helps no one fix anything.
- 05
The limits of a test
A penetration test is a snapshot at a given moment, within a given scope. It cannot prove that no other vulnerability exists.
What drives the cost of penetration testing
We price each test after scoping, with a clear quote. The main factors are as follows.
- 01
Size of the scope
The number of websites, applications, addresses or interfaces to test.
- 02
Functional depth
The number of dynamic pages, forms, user roles and journeys such as ordering or payment.
- 03
Type of test
Black, grey or white box: the more information we have, the more thorough the analysis, and the effort varies accordingly.
- 04
Constraints
Out-of-hours windows, a test environment to prepare, time on site.
- 05
Retesting
One or more checks after the fixes, depending on how many vulnerabilities need closing.
Technologies and methods
- OWASP
- Web application testing
- Black, grey or white box
- Rules of engagement
- Retesting
Frequently asked questions
Could a penetration test take my website offline?
The risk is low but never zero. That is why tests are scheduled, checks likely to disrupt the service are excluded or run on a test environment, and an emergency contact remains reachable throughout the engagement.
What is the difference between a vulnerability scan and a pentest?
A scan is automated: it spots known weaknesses and produces false alarms. A pentest adds human analysis: it checks what can really be exploited, connects the findings and tests the logic specific to your application.
Do I need to tell my hosting provider?
Often, yes. Some hosting providers and online services regulate security testing in their terms of use. We check this with you during scoping, before anything else happens.
My site runs on WordPress. Is a test still useful?
Yes. A CMS, or content management system, such as WordPress relies on plug-ins, themes and admin accounts that are frequent entry points. A poor configuration can expose information even when the software itself is up to date.
How often should a penetration test be repeated?
There is no single rule. The most sensible approach is to test again after each significant change to your website or infrastructure, and to keep on top of security updates in between.