Penetration testing for SMEs in Bastia and Corsica
Penetration testing, or pentesting, is a simulated attack carried out with your written authorisation. Its purpose is to find the vulnerabilities in your website, your application or your internet-facing services that could really be exploited. We run these tests from Bastia for SMEs, startups or public bodies, within a scope agreed in advance. Afterwards we explain in plain terms what to fix, and in what order.
What is a penetration test?
A pentest means stepping into an attacker's shoes, but with your consent and under precise rules. The point is not to draw up a theoretical list of weaknesses. It is to check which ones can actually be exploited, and what that would cost your business.
An automated scan is not enough. The tool spots software versions known to be vulnerable, often listed under a CVE identifier, the public number given to a known flaw. In a penetration test, a person also studies the logic of your application, cross-checks what they observe and throws out the false alarms.
There are three approaches, depending on what you share with us. In a black-box test we start from nothing, like an outside attacker. In a grey-box test we have a user account. In a white-box test we can see the documentation, sometimes even the code.
Website penetration testing, when to plan it
- 01
Before going live
A new online shop, a customer area, a mobile app. Testing before launch lets you fix things without pressure, with no real data at stake.
- 02
After a major change
A new payment module, extra user accounts, a move to another host. Any change can open a gap that earlier tests never covered.
- 03
When a client or partner asks
Large clients, public buyers and insurers ask more and more questions about the security of your tools. With a recent test report, you answer on facts.
- 04
When you handle sensitive data
Health data, identity documents, bank details, case files on members of the public. The worse a leak would be, the more it is worth checking your defences.
Penetration testing for SMEs, a few examples by sector
- 01
E-commerce
Checkout, discount codes, customer accounts, payment. We check that one customer cannot see another's orders, or change a price.
- 02
Tourism and hospitality
The booking engine, contact forms and admin interfaces, often put in place by different providers. Worth checking before the season.
- 03
Professional and healthcare practices
Appointment booking portals and document sharing, where confidentiality is a professional obligation.
- 04
Startups and software publishers
The online platform and the APIs, meaning the access points your applications use to exchange data.
- 05
Local authorities and public bodies
Online service portals, and every form that collects personal information about the public.
How an authorised penetration test runs
No test starts without prior written authorisation, signed by someone entitled to give it. Nor without rules of engagement agreed together.
- 01
Understand and scope
We talk about your business, your tools and what worries you. Then we set the exact scope, with the exclusions, the type of test and the permitted time windows.
- 02
Prepare
On your side, you check your backups, provide the agreed test accounts and tell your hosting provider if their terms require it. Each party names an emergency contact.
- 03
Test
We run the tests within the agreed scope and schedule, following public methods such as the OWASP testing guide. If a critical flaw turns up, you hear about it at once, without waiting for the report.
- 04
Report back
We hand over the report and walk you through it in a meeting, by video call or on your premises in Haute-Corse. Every point has to be understood.
- 05
Verify
Once your fixes are in, a retest confirms that the reported vulnerabilities are properly closed.
The penetration test report, and what happens after
The report has two readers. Management gets a summary in everyday language, setting out the level of risk and the priorities. The detailed part is for the person or provider who will do the fixing, and gives for each flaw its severity, the evidence for it and the recommended fix.
The report belongs to you. We do not share it. Any data viewed during testing is deleted at the end of the engagement, as provided for in the rules of engagement.
After that, you fix things with your usual provider, or hand the remediation to us. Testing again makes sense after each major change to your website or application, rather than on a fixed date.
What to check before ordering a pentest
- 01
Who signs the authorisation
The person authorising the test must have the power to do so for every system tested. For a site hosted by a third party or an online service, the supplier's consent may be needed.
- 02
A realistic scope
Better to test what matters thoroughly than skim over everything. The scope should follow your real risks, not whatever is easy to test.
- 03
Live or test environment
On a staging environment, your customers run no risk. On the live system, you see reality as it is. We make that choice together, knowing the trade-offs.
- 04
A usable report
Ask to see how the report is put together. A raw list of automated tool output has never helped anyone fix anything.
- 05
The limits of a test
A penetration test is a snapshot of a given scope, at a given moment. It does not prove that no other flaw exists.
What drives the cost of a penetration test
We price each test after scoping, with a clear quote. Here is what weighs most.
- 01
Size of the scope
How many websites, applications, addresses or interfaces need testing.
- 02
Functional depth
The number of dynamic pages and forms, the different user roles, the journeys such as ordering or paying.
- 03
Type of test
Black, grey or white box. The more information we have, the further the analysis goes, and the effort follows.
- 04
Constraints
Night-time windows, a test environment to prepare, work on site.
- 05
Retesting
One check after the fixes, or several, depending on how many flaws need closing.
Technologies and methods
- OWASP
- Web application testing
- Black, grey or white box
- Rules of engagement
- Retesting
Frequently asked questions
Can a penetration test take my website offline?
The risk is low, never zero. So tests are scheduled, and any checks that could disrupt the service are either excluded or run on a test environment. An emergency contact stays reachable from start to finish.
What is the difference between a vulnerability scan and a pentest?
A scan is automated. It spots known weaknesses, along with its share of false alarms. A pentest adds human judgement, which checks what is really exploitable, cross-checks the findings and tests the logic specific to your application.
Do I need to tell my hosting provider?
Often, yes. Some hosts and online services set rules for security testing in their terms of use, and we check this with you during scoping, before anything is done.
My site runs on WordPress. Is a test worth it?
Yes. A CMS (a content management tool such as WordPress) relies on plugins, themes and admin accounts, which are frequent ways in. Even when it is up to date, a badly configured site can leak information.
How often should a penetration test be repeated?
There is no single rule. The sensible approach is to test again after each major change to the site or infrastructure. Between two tests, keep up with security updates.