Application & infrastructure pentesting

• Teams before a release You’re about to ship a new application or a major change, and you want someone to try to break it first.
• Companies asked for a pentest report A customer, an auditor or a framework such as ISO 27001, SOC 2, DORA or NIS2 requires one.
• Consultancies You need a pentester for a client engagement. I work as a subcontractor and can deliver under your brand.

We agree the scope before testing starts. It can cover one of these areas or several.

• Web applications and APIs REST and GraphQL. Authentication, access controls and business logic.
• Mobile apps iOS and Android.
• Cloud around the application Azure, AWS, GCP and Kubernetes.
• External perimeter What an attacker can reach from the internet.
• Internal network and Active Directory What an attacker can do from inside your network.

I can test as black box (no information from you), grey box (with accounts or documentation) or white box (with the source code).

Frameworks: OWASP WSTG · OWASP API Security Top 10 · OWASP MASVS / MASTG (mobile) · PTES

1. Scoping & authorization

   Targets, goals, dates and limits, and the approach: black, grey or white box. If a customer or an auditor expects the report, tell me what it must cover. We also agree whether AI tools may be used on your data: local models by default, cloud models only with your written agreement. You get signed rules of engagement and a quote before testing starts.

2. Testing

   Manual, with tooling as support. If I find something critical, I tell you as soon as I find it, not at the end.

3. Report & debrief

   Proof, impact and concrete fixes, ranked by risk. Then a call with your team to go through it.

4. Retest

   Once the fixes ship, I verify them and send you an updated report.

• The report Findings you can reproduce, their impact, and concrete fixes ranked by risk. In French or English, as you prefer.
• An attestation letter One page: scope, dates and results. You can share it with customers or auditors without handing over the full report.
• A debrief call I go through the findings with your team.
• A retest I verify the fixes and update the report.

Application & cloud security / Pentest From a file import to Owner on Azure From a standard user account on an API management product, I chained seven steps to Owner on the Azure subscription hosting it. Read the case study

What do I need to prepare?

Not much before we talk. At scoping we agree the targets, goals, dates and limits. For grey or white box tests, I’ll ask you for accounts, documentation or the source code.

Will it disrupt production?

I prefer to test on staging. If we test production, it’s within limits we agree beforehand: no destructive tests, and agreed time windows. They’re written into the rules of engagement.

Can you work under our brand?

Yes. I work as a subcontractor for consultancies, and I can deliver the report under your brand.

Do you sign an NDA?

Yes, if you need one. Rules of engagement are signed before testing either way. Evidence and your data stay encrypted during the engagement and are deleted 90 days after the final report.

What happens after the report?

We have a debrief call to go through the findings. Your team fixes what needs fixing, and once the fixes ship I retest them and send an updated report.