Before an engagement
What does enterprise penetration testing cover?
Web application penetration testing; API penetration testing; Network and Active Directory penetration testing; Cloud penetration testing; Mobile application penetration testing; Penetration test retesting. The agreed scope defines specific assets, roles, interfaces and exclusions.
Can you test production systems?
Use written authorisation, agreed environments, synthetic data and named stop authority. Define rate limits, excluded methods, cleanup and escalation before testing. Production activity and supplier systems require explicit permission. Production testing requires explicit agreement; staging and production results must not be presented as interchangeable.
Is this the same as a vulnerability scan?
No. A scan can support discovery, but penetration testing validates selected weaknesses and their consequences in the authorised environment. The report should distinguish unverified observations from demonstrated findings.
Does a pentest establish compliance?
A penetration test can support a security programme, customer assurance or contractual requirement. The required scope, frequency, independence and evidence depend on the applicable standard and agreement. A generic test is not a compliance certificate, and statutory DORA TLPT is a separate engagement with additional requirements.
How long does an engagement take and what does it cost?
Duration and fees depend on scope, roles, workflows, access conditions, third-party involvement and reporting/retest needs. These are agreed in a proposal rather than inferred from a generic package.
What will we receive?
An agreed coverage record, technical findings, evidence, impact limits and remediation plan. Retesting and additional operational exercises are specified in the statement of work.
Is the sample a real client report?
No. Meridian Group AG, every system, participant and result are fictional. The sample illustrates technical reporting without exposing client information.
What happens to the details submitted for a sample?
Atlant Security receives your request through its business mailbox, makes the browser download available and may follow up about the request. You are not enrolled in marketing. See the privacy and cookie notices.
What should we include in an enquiry?
Your organisation, role, high-level systems or workflows, objective and likely timing. Do not send patient records, payment data, credentials or confidential security details through the public form.
