# Penetration Testing

> Test the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.

Canonical page: https://www.guvenkaya.co/services/penetration-testing

**Find exploitable paths across your applications and infrastructure.** We test web, mobile, APIs, cloud, and identity for paths to sensitive data and privileged access.

## Test the path an attacker would actually take.

- **Web, mobile, API & backend**: Authentication, sessions, authorization, business logic, data exposure, and integration boundaries.
- **External, cloud & infrastructure**: Internet-facing services, cloud control planes, secrets, CI/CD, storage, and remote access.
- **Internal, network & identity**: Segmentation, privileged access, lateral movement, internal services, and trust relationships.

## When to test

- **Before launch**: Test exposed services and critical workflows before launch.
- **After change**: After a major cloud, identity, network, or architecture change.
- **Before external review**: A customer, insurer, or auditor needs evidence of security testing.
- **After an incident or concern**: After an incident, acquisition, or concern about an exposed path.

## How we test your systems.

1. **Set the scope and build the threat model**: Agree targets, testing windows, exclusions, and stop conditions. Map the actors, entry points, and trust boundaries in the tested environment.
2. **Trace and test attack paths**: Test how an attacker could gain access, escalate privileges, and reach sensitive data or actions. Record which security properties hold and where controls fail.
3. **Capture evidence and reproductions**: Validate findings within the agreed rules. Document preconditions, reproduction steps, and remediation so your engineers can investigate and rerun the tests.
4. **Retest fixes and document conclusions**: We always verify fixes through retesting and record their status. Tie the principal’s signed opinion to the tested environment, scope, and evidence.

## Deliverables

- **Findings report**: Validated findings with evidence, attack preconditions, and remediation guidance.
- **Threat model**: Actors, trust boundaries, and attack scenarios, including those blocked by existing controls.
- **Record of flows and security properties tested**: How an attacker could enter, escalate, move, and reach a sensitive outcome, and which properties along that path held.
- **Invariant register**: The security properties tested, the results, and supporting evidence.
- **Evidence and reproductions**: The paths we proved, in a form your engineers can rerun.
- **Signed opinion on the reviewed baseline**: The principal’s conclusions, tied to the tested environment, scope, and evidence.

## Engagement team

- **Łukasz Mikuła**, Specialist Advisor: Offensive security, exploit development, mobile, infrastructure, and multi-ecosystem reviews.
- **Michal Bajor**, Specialist Advisor: Exchange, funding, custody, API, web application, red-team, and L1 security.
- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.

## Published reports

- [Sailor Lend: Web Application Security Review](https://github.com/Guvenkaya/public-reports/blob/master/Sailor-Lend-Web-Application-Security-Review-Final.pdf)
- [Jump DeFi: Backend & Frontend Security Assessment](https://github.com/Guvenkaya/public-reports/blob/master/Jump-Defi-Backend-And-Frontend-Security-Assessment.pdf)
- [Cleopetra: Solana Trading Bot Security Review](https://github.com/Guvenkaya/public-reports/blob/master/Cleopetra-Solana-Trading-Bot-Security-Review-Final-Report.pdf)

## Frequently asked questions

### Can you test production systems?

Yes, when rules, access, timing, data handling, and stop conditions make the risk acceptable. Some cases may move to staging.

### What access and test accounts do you need?

We agree the targets and access during scoping. Testing authenticated workflows needs representative accounts for the roles in scope, plus details of expected permissions and business rules. Infrastructure testing may require network or environment access. If the engagement includes code review, we also need access to the code during scoping.

### Do you use automated scanners?

Tools support discovery and coverage, but the engagement is manual, architecture-aware testing and validation.

### Can you test authenticated roles and business logic?

Yes. Representative accounts, roles, workflows, and expected behavior let us evaluate authorization and business-critical paths.

### Do you retest findings?

Yes. We always provide remediation guidance and verify fixes through retesting. The proposal defines the retest window and access requirements, and the final report records the results.

### What determines the price and duration?

The number of applications, user roles, environments, and workflows affects the effort, along with the depth of testing. We define the testing window, access requirements, and retest scope in the proposal.

## Related services

- [Secure Code Reviews](https://www.guvenkaya.co/services/secure-code-review.md): Find security flaws in critical code, including authorization, business logic, and state changes.
- [Security Reviews](https://www.guvenkaya.co/services/security-reviews.md): Seven focused reviews across applications, blockchain systems, cryptography, custody, and AI workflows, matched to the layer your risk sits in.
- [Risk Assessment](https://www.guvenkaya.co/services/risk-assessment.md): Give leadership a prioritized view of where security risk concentrates and what to address first.
- [Smart Contract Security Reviews](https://www.guvenkaya.co/services/smart-contract-security-review.md): Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.

## Discuss your penetration test.

Describe the application, environment, and deadline. We will propose the scope and testing rules.

Discuss your scope: https://www.guvenkaya.co/contact