Protecting businesses in every province and territory
Experiencing a breach? Get help now
Penetration testing
Our OSCP and GIAC certified testers break in the way real criminals would, then hand you a clear, prioritized fix list that your team, auditors and insurers can act on.
CONSOLEDemo tenantSOC online00:00:00 ET3MTEngagements / PT-2026-114
Attack path
Attack path 1 of 3 · 146 evidence items
External internet to finance data
External recon
3 exposed services on 203.0.113.0/28
09:02
Password spray on SSL VPN portal
vpn.northshore-example.ca
09:40
VPN session as j.morin
Single factor, no MFA on VPN
10:05
Lateral move to finance workstation
WS-FIN-07 via SMB
10:48
Kerberoast service account
svc_backup, cracked offline in 14 min
11:30
Domain compromise via DCSync
DC01.corp.northshore.local
12:16
Finance share readable
\\FIN-FS01\Finance$
12:44
Root cause
VPN without MFA
Detected by EDR
2 of 7 steps
Fix that breaks path
Enforce MFA
Certified partner of
Why this cannot wait
Overview
A penetration test is an authorized, simulated attack by skilled testers to find weaknesses in your systems and prove what an attacker could do with them. Cyberphore combines automated discovery with manual testing, proves impact without causing damage and gives you a prioritized plan to fix what matters. Tests are scoped in writing and run on your schedule.
One is a list. The other is a story with evidence that your board, your customers and your engineers can act on, and it tells you exactly what to fix first.
Test types
Most SMBs start with external and internal network testing plus their most important web application. We help you choose the scope during the scoping call.
| Test type | The question it answers | What is tested |
|---|---|---|
| External networkCommon starting scope | What can an attacker on the internet reach and exploit? | Internet-facing systems, VPNs, firewalls, email infrastructure and exposed services. |
| Internal networkCommon starting scope | If someone clicks a phishing link, how far can they get? | What an attacker can reach after a phishing click or a compromised device, including Active Directory attack paths. |
| Web application and APICommon starting scope | Can users see other users’ data, bypass payment or take over accounts? | Authentication, authorization, business logic and injection testing aligned with OWASP guidance. |
| Cloud | Is Azure, AWS, Google Cloud or Microsoft 365 configured so a single mistake leads to compromise? | Microsoft 365, Azure, AWS and Google Cloud, from misconfiguration to privilege escalation. |
| Wireless | Can someone in the parking lot get onto your internal network? | Staff and guest Wi-Fi, including segmentation between them and internal systems. |
| Social engineering | Will staff hand over credentials or let a stranger into the building? | Phishing, phone pretexting and, where agreed, physical access tests of people and processes. |
The approach changes how much of your budget goes on discovery and how much on finding issues. We recommend one during scoping.
Black box
No inside information
Realistic, but spends much of the budget on discovery.
Grey boxUsually recommended
Some credentials or documentation
The best value for most SMBs: realistic access with more time spent finding issues.
White box
Credentials, documentation or code
Finds more issues in the same time.
Engagement
A short call on your business, systems and reason for testing. We agree targets, exclusions, timing, contacts and rules of engagement, and you sign written authorization. Nothing is tested without it.
Automated tools map the attack surface. Testers validate findings, look for business logic flaws, chain weaknesses into attack paths and work toward the objectives you care about.
The full report arrives within 5 business days of testing finishing: executive summary, technical detail with evidence and prioritized recommendations.
We walk through findings with your team and IT provider. One retest of fixed findings within 90 days is included, and the report is updated.
Throughout testing: if testers find something critical, such as an exposed database or a working remote code execution, we call you immediately. We do not hold it for the report.
Testing stays within the windows, targets and techniques agreed in writing. Destructive actions are avoided unless you approve them, and fragile systems can be excluded or tested carefully outside business hours.
Screen shows sample data. Every session is logged as evidence and secrets are redacted in the report.
Report
Each finding is rated by real-world risk to your business, not just a generic severity score. Here is what a good report contains, and who relies on each part.
FINDING PT-114-03
SSL VPN accepts password spraying without lockout or MFA
Evidence
Remediation
Sample finding page. Names, hosts and dates are illustrative.
A report is only valuable if it changes something. After the debrief:
Fix critical and high first
Especially anything internet-facing, or anything that led to domain or cloud administrator access.
Look for patterns
Five findings caused by the same weak password policy are one problem, not five.
Assign owners and dates
Track them like any other project.
Retest
Confirm the fixes worked. One retest within 90 days is included.
Feed the next cycle
Carry lessons into vulnerability management and the scope of your next test.
Customers and auditors often ask for evidence that findings were remediated, not just that a test happened. Ongoing scanning between tests is part of vulnerability management.
Scan vs test
Most organizations need both. Scanning keeps watch for new weaknesses between tests; a test shows what an attacker could actually do with them.
| Vulnerability scan | Penetration test | |
|---|---|---|
| How it works | Automated tools find known weaknesses at scale | Skilled testers exploit weaknesses, chain them together and show real impact |
| Depth and frequency | Broad and frequent | Deep and periodic, at least once a year and after significant changes |
| Business logic flaws | Not understood by tools | Tested manually, for example bypassing payment or seeing another user’s data |
| Attack paths | Not shown | Shown step by step, such as a phishing click leading to domain administrator |
| What you receive | A list of findings | A story with evidence that tells you exactly what to fix first |
How it works
Depth and frequency
Business logic flaws
Attack paths
What you receive
Choosing a provider
Ask them of every provider you speak to, including us. Here are our answers.
Be wary of very low prices for very large scopes. That usually means an automated scan with a penetration test label on it. It may satisfy a checkbox, but it will not find business logic flaws or show realistic attack paths.
Canadian considerations
Canadian enterprises, financial institutions and public bodies increasingly require vendors to provide a recent independent penetration test summary. Defence suppliers working toward the Canadian Program for Cyber Security Certification (CPCSC) will find testing useful as evidence of control effectiveness.
SOC 2 and ISO 27001 do not mandate penetration testing in exactly the same way, but auditors commonly expect it as part of vulnerability and risk management. PCI DSS explicitly requires penetration testing for in-scope environments.
Tie testing to your audit timelineSome Canadian cyber insurers ask whether you test regularly. A recent report with remediation evidence supports your application.
Cyber insurance readinessUnauthorized access to computer systems is an offence under the Criminal Code. Third-party systems in scope, such as hosted applications or cloud services, must be covered by the provider’s testing policy and your contracts. We raise this during scoping.
General information, not legal advice.
FAQ
Cost depends on scope: the number of external IP addresses, internal network size, the number and complexity of web applications and APIs, cloud accounts and whether social engineering is included. A small external test is a very different job from a full internal and application assessment. We quote a fixed price after a short scoping call. Pricing depends on your environment and scope, so we provide a written quote in CAD after a free scoping call.
At least once a year, and after significant changes such as launching a new application, migrating to the cloud, merging networks after an acquisition or changing your remote access setup. Many SOC 2 and ISO 27001 programs, customer contracts and cyber insurers expect annual testing. Between tests, continuous vulnerability scanning keeps an eye on new weaknesses.
It should not. Testing windows, targets and techniques are agreed in writing beforehand, and testers avoid destructive actions unless you explicitly approve them. Fragile systems such as older production equipment or legacy servers can be excluded or tested carefully outside business hours. If a tester finds something critical, we tell you immediately rather than waiting for the report.
A vulnerability scan uses automated tools to find known weaknesses at scale. A penetration test goes further: skilled testers try to exploit weaknesses, chain them together and show real impact, such as moving from a phishing click to domain administrator. Scans are broad and frequent. Penetration tests are deep and periodic. Most organizations need both.
Look for recognized hands-on certifications such as OSCP, OSWE, GPEN or CREST qualifications, plus real experience with environments like yours. Ask who will do the testing, not just who sells it, and ask for a sample report. Every test is led by OSCP and GIAC GPEN certified testers.
Black box testing gives testers no inside information, which is realistic but spends much of your budget on discovery. White box or grey box testing gives testers credentials, documentation or code, which finds more issues in the same time. For most SMBs, grey box testing offers the best value. We recommend an approach during scoping.
Get started
A free 30-minute scoping call with a certified specialist. You leave with a recommended scope and approach, and a written quote in CAD follows.
Book well before your deadline. Leaving time to fix findings and retest means the report you hand a customer or auditor shows closed issues, not an open list.
Incident happening now? Call 24/7: +1 236 665 1165