Penetration Testing FAQ

Penetration testing (a pentest, or ethical hacking) is a structured security assessment where a certified tester tries to exploit vulnerabilities in your systems before real attackers do. Zero Day Security tests web applications, APIs, networks, wireless and AI/LLM applications, and delivers a report with proof-of-concept findings and clear remediation guidance.

Testing is performed by a CREST Registered Penetration Tester (CRT) who also holds CREST CPSA, OffSec OSCP, OSWA and OSWP, and the Hack The Box Certified Offensive AI Expert (HTB COAE). You work directly with the certified tester doing the work, with no handoff to a junior.

Pricing is fixed and agreed in writing before testing starts, and every engagement includes a free retest. Current packages are listed on the Pricing page. Book a free scoping call for an exact quote.

A single web application or API test is typically delivered in 1-2 weeks. A network test at our standard scope takes about 2 weeks; larger networks take longer. A combined web application and network engagement usually takes 2-3 weeks. Timelines are agreed during scoping, so testing never becomes the bottleneck on your release or audit.

AI and LLM penetration testing checks chatbots, LLM-powered apps, RAG pipelines and AI agents for prompt injection, jailbreaks, sensitive data leakage, insecure tool use and insecure output handling. Findings are mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS, and testing is led by an HTB Certified Offensive AI Expert (HTB COAE).

Yes. Our tests and reports are built for PCI DSS v4.0 Requirement 11.4, covering internal and external penetration testing and segmentation testing, with the scope, methodology and finding detail your QSA expects.

The HIPAA Security Rule requires a risk analysis and periodic technical evaluation of your safeguards. A penetration test is one of the strongest pieces of evidence for both, and our reports map findings to HIPAA technical safeguards with clear remediation guidance.

SOC 2 doesn't strictly name penetration testing, but most auditors expect one as evidence for your monitoring and vulnerability management controls. Our compliance-mapped reports give your auditor that evidence.

Yes. OSWP-certified wireless testing covers WPA2/WPA3 and enterprise Wi-Fi, rogue access points, guest network isolation and segmentation between wireless and internal networks.

An executive summary with risk ratings, detailed technical findings with proof-of-concept evidence, CVSS severity scores, step-by-step reproduction instructions, prioritized remediation guidance, and compliance mapping for PCI DSS, HIPAA and SOC 2. A free retest is included after you remediate.

A vulnerability scan is automated: it flags known weaknesses but can't confirm they are exploitable or test business logic. A penetration test is human-led: a tester exploits vulnerabilities to show real-world impact, chains issues together and tests the application-specific logic scanners miss. Most compliance frameworks require a penetration test, not just a scan.

At least once a year, and after any significant change to your application or infrastructure. PCI DSS requires annual testing and testing after significant changes, and SOC 2 and HIPAA auditors typically expect annual testing too. Security-mature teams often test quarterly.

Yes. The Focused Assessment is built for startups with a small app or API, or a first penetration test, and the Standard Assessment tests one full web application or API end to end. Both include OWASP Top 10 and business logic testing, a compliance-ready report and a free retest, which is typically what you need for a SOC 2 audit or an investor security review. See the Pricing page for current rates.