Our penetration
testing services
OffSec offers penetration testing services to a select set of customers, with an average of only 10 clients per year. Our assessments have a two-week minimum engagement length, with the average engagement being four weeks long.
An OffSec penetration assessment will help determine the weaknesses in networks, computer systems, and applications. Unlike other companies who focus on assembly line assessments, we take a unique approach
Our penetration testing services are not merely scanning for vulnerabilities and handing in a report. Quite simply: if all you are looking for is a checklist assessment, we're not the right solution for you.
Our team
When we perform a penetration test, we don't send you a second-tier group of consultants. Our in-house experts perform all security services. Clients get the same penetration testing team that teaches the classes, creates our tools, and writes the books. They are recognized leaders in performance-based infosec training and have authored exploits and pentesting tools, including Kali Linux and the Exploit-DB.
Our clients
Our clients include government entities, financial institutions, healthcare companies, manufacturing and technology groups, and others.
Ideal customers are either in a high-risk position or have reached a maturity level where a traditional penetration test is unable to deliver sufficient results.
Our approach
We focus on long-term relationships with our clients to ensure they get the best penetration test possible. We work with you to build an accurate profile of your primary business function, where threats originate, and the goal of your security assessment. This ensures that the work conducted meets your specific needs.
We take on only a single customer at a time. Unfortunately, this means we can't accept every opportunity.
Other services
Why an advanced attack simulation?
Organizations that have already hardened their systems face a dilemma: how to get further success in penetration testing.
The common approaches won't deliver results for well-defended organizations. Commodity vulnerability assessment tools or off-the-shelf attacks and exploits will not be effective. Successful testing requires advanced attacks by security experts.
A penetration test over a two-to-three week period of time does not adequately allow for this to occur. However, the cost of conducting a multi-month assessment isn't part of many organizational budgets. This is where OffSec shines.
The advanced attack simulation is for very specific environments. Your information security program and defenses must be mature enough to justify this level of vulnerability assessment. However, if you are increasingly frustrated with finding an assessment team that can handle your environment, this may be the perfect fit for you.
These hardened environments are what we love to work in. A job that requires us to stretch and find new attack methodologies is what our services are ideal for. If your organization desires this assessment level, contact us to discuss your options.
Advanced attack simulation services
A real attacker is not subject to an artificial time limit when it comes to building an effective assault against your organization. While an unlimited timetable is not realistic as a service, we have found effective methods of shortening this process.
The most important ingredient for building a custom attack is information. Paying an assessment team to collect information you already possess is neither efficient nor cost-effective. We bypass this by sitting down with your team to have you teach us about your company and systems. We depend on your expertise to walk us through your environment in an interactive manner.
This process alone can save you months of effort and cost.
Using the information provided, we create a simulation of the target environment in our labs. We model potential attack points and develop custom attacks for each organization.
After we've constructed a series of attacks, we start the active phase of the assessment. We put the new attacks to work, modifying them where needed based on differences encountered in the real world compared to the labs. At this point, OffSec can simulate a determined attacker in a manner that would not be possible without spending many months on the project.
Application security assessment
An application security assessment is a crucial part of every company's software development life-cycle. Organizations often face the difficulty of finding an experienced team of analysts to conduct a high quality, intensive, and non-automated application security assessment. We have indeed built a strong reputation in vulnerability discovery, exploit development and penetration testing services. As this is our area of expertise, we are perfectly suited to use our extensive knowledge for your next application security assessment.
Our expert security team conducts an in-depth vulnerability analysis of the target application. Our comprehensive application security assessments are conducted using all necessary methodologies, including reverse engineering, protocol analysis of legitimate traffic and protocol fuzzing, as well as manual traditional and custom attacks against the exposed attack surface. In cases where interaction with the developers is possible, OffSec makes use of all communication channels extensively. In any case, our application security assessment services offer companies the confidence and expertise needed for secure software deployment across their organization.
Is OffSec right for you?
If you need a penetration test, we want to talk with you.
This is what you can expect:
- When you contact us, we don't have a sales person contact you. Instead, one of our team members will work with you to determine if we are a good mutual fit.
- Rules of engagement will be set that meet the goals that you defined. As work is conducted we will be sure to keep you informed every step of the way. Our goal is no surprises on the report as you are kept involved on an on-going basis.
- A report will be created that informs you as to what was discovered and what we suggest to correct any issues.