Penetration testing

A penetration test (pentest) is a controlled security assessment in which a specialist uses the techniques of a real attacker to try to break into your systems. Secure Sense performs pentests for SMEs in the Netherlands: web applications, APIs, networks and Microsoft 365 environments. You receive a clear report that lists every risk and how to fix it, and you always deal directly with the specialist who does the testing.

What is a pentest?

In a pentest an ethical hacker takes on the role of an attacker and actually tries to get in: through vulnerabilities in your application, misconfigurations, weak passwords or insecure integrations. The difference with a real attack? Everything happens with your permission, within an agreed scope, and every finding is documented so you can fix it.

Secure Sense tests manually according to recognized methodologies, including the OWASP Top 10, supported by professional tooling. Every finding is verified by hand, so you do not get a report full of false alarms but a list of real, proven risks.

When do you need a pentest?

The most common reasons:

• A customer or partner asks for proof. More and more large organizations fall under the Dutch Cyberbeveiligingswet (NIS2 law) and must be able to show that their suppliers are secure. A recent pentest report is the proof you provide.
• You want to obtain or keep ISO 27001. Certification bodies expect you to test the effectiveness of your security on a regular basis.
• Something new is going live. A new web application, a major release, an integration with an external party: the moment to test before attackers do.
• Your cyber insurer has requirements. Insurers increasingly ask for demonstrable measures and periodic testing.
• You have had an incident. After an attack or data breach you want to be sure that the doors are now really closed.
• You simply want to know where you stand. Even without a specific trigger, a pentest is the fastest route from assumptions to facts.

Which pentests do we perform?

Web application and API. Websites, online stores, customer portals, SaaS applications and APIs. We test against the OWASP Top 10 and more: from injection and access control to session management and logic flaws. Optionally combined with a secure code review of the source code. More about the web application pentest

Network and infrastructure. Your office network, servers, Wi-Fi and remote access, tested from the outside and from the inside. How far does an attacker get after taking over a single workstation or the guest network? More about the network pentest

Microsoft 365. The place where your email, documents and identities come together, which makes it a favorite target. We check the configuration and show what an attacker could do with a stolen account. More about the Microsoft 365 audit

Custom scope. Cloud environments, SaaS platforms such as Salesforce and AFAS, or a combination with a phishing simulation: in the intake call we define the right scope together. View all services

Black box, gray box or white box?

The difference is how much prior knowledge the tester gets. In a black box test we know nothing in advance and approach your systems as an outsider. In a gray box test we get limited prior knowledge, such as a user account or documentation. In a white box test we get full access, up to and including the source code.

For most organizations gray box is the best choice: the test goes deeper because no time is lost on guesswork, and you see what both an outsider and a logged-in user can achieve. In the intake call we advise what fits your situation and goal.

Our approach in six steps

Step 1: Introduction and intake. Free of charge. We discuss the reason, the goal and the scope: what we test and what we do not.

Step 2: Quote with a fixed price. Based on the intake call you receive a quote with a fixed price and a clear scope.

Step 3: Preparation. We schedule the test period, exchange contact details and formally record your authorization. Where needed your hosting provider is informed as well; we help you with that.

Step 4: Testing. The pentest is performed manually, supported by tooling. If we find a critical vulnerability we report it immediately, so you do not have to wait for the report.

Step 5: Report and personal walkthrough. After completion you receive the report and we go through it together, with your IT provider present if you wish.

Step 6: Remediation and optional retest. Once the fixes are in place we check on request whether everything is really closed.

What does the pentest report contain?

The report is written for two readers at once. The management summary gives the big picture in plain language: where you stand and what deserves priority. The technical section gives for each finding the risk rating (based on CVSS), the evidence with steps to reproduce and concrete remediation advice. You can share the report directly with your management, your IT provider or the customer who asked for proof.

Why Secure Sense?

What you can expect from us:

• The specialist who does the work. No account managers: from intake to retest you deal with the same person who tests your systems.
• Since 2019. Secure Sense has been helping Dutch businesses with pentests, security audits and resilience.
• Manual and verified. Recognized methodologies such as the OWASP Top 10, every finding proven and checked for false positives.
• Clear report. Understandable for management, concrete for the technical team.
• Fixed price, discreet. A fixed price up front and strict confidentiality, laid down in our agreements.

Frequently asked questions about pentests

What does a pentest cost?
That depends on the scope, depth and type of test. After a free intake call you receive a quote with a fixed price. Read which factors determine the price.

How long does a pentest take?
Most pentests involve 16 to 40 hours of testing, spread over one to two weeks depending on the scope. The report follows after that.

Can a pentest disrupt our systems?
We test carefully and agree in advance on risky actions, test windows and the possible use of a staging environment. The chance of disruption is therefore small.

What do you need from us?
A clear scope, a contact person, formal authorization and in the case of a gray box test a test account. We guide you through the preparation.

Is a pentest mandatory?
No law requires every company to have a pentest, but the NIS2 law, ISO 27001, customers and insurers increasingly ask for demonstrable proof.

How often is a pentest needed?
Rule of thumb: at least once a year, and also after major changes. Between pentests, vulnerability scanning keeps an eye on your environment.

Want to know where you stand? Schedule a free intake call or request a quote right away. You will hear personally from the specialist who will actually perform your pentest.

Last updated: October 20, 2026.