Vigilon Penetration Testing & Vulnerability Scanning
Uncover exploitable vulnerabilities before attackers do. Our expert testers simulate real-world attacks to assess and strengthen your security posture.
Why Penetration Testing?
Automated scanning catches the low-hanging fruit — but sophisticated attackers chain together subtle weaknesses that scanners miss. Penetration testing combines automated tools with manual expert analysis to identify vulnerabilities that real adversaries would exploit.
Regular penetration testing is also increasingly required for regulatory compliance, including under the Cyber Resilience Act, EN 18031, and sector-specific regulations.
Our Testing Scope
Web Application Testing
Comprehensive testing of web applications following OWASP Testing Guide v4 and the OWASP Top 10. We assess authentication, authorisation, session management, input validation, business logic, and more.
API Security Testing
In-depth assessment of REST, GraphQL, and SOAP APIs against the OWASP API Security Top 10. We test authentication mechanisms, rate limiting, data exposure, injection flaws, and access control.
IoT Device Testing
Hardware and firmware security assessment including network services, update mechanisms, debug interfaces, communication protocols, and physical attack vectors.
Mobile Application Testing
Assessment of iOS and Android applications following the OWASP Mobile Application Security Verification Standard (MASVS), covering data storage, cryptography, authentication, and network communications.
Cloud Infrastructure Testing
Assessment of cloud environments (AWS, Azure, GCP) including identity and access management, network configuration, storage security, and serverless function security.
Vulnerability Scanning
Continuous automated vulnerability scanning of your external attack surface, internal networks, and cloud environments. We tune scan profiles to minimise false positives and deliver actionable results.
Our Methodology
We follow industry-recognised methodologies including:
- OWASP Testing Guide — for web and API testing
- PTES (Penetration Testing Execution Standard) — for structured engagement delivery
- OSSTMM (Open Source Security Testing Methodology Manual) — for operational security testing
- NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment
Deliverables
Every engagement includes:
- Executive summary for senior stakeholders
- Detailed technical findings with evidence and reproduction steps
- Risk ratings aligned to CVSS v4.0
- Prioritised remediation guidance
- Free retest of remediated findings within 30 days
"A penetration test is a point-in-time assessment. Pair it with continuous vulnerability scanning and regular retesting to maintain a strong security posture."
Penetration testing integrates with our risk assessment and threat modelling services to give you a complete picture of your security risk profile.