Authorized exercise
Test your security before someone else does
A penetration test is an authorized exercise in which we look, in a controlled way, for the weaknesses someone could take advantage of in the assets we agree on.
What it's for
To move from assuming something is protected to having evidence of what can be exploited, with what impact, and what is worth fixing first.
What it helps you avoid
When a penetration test makes sense:
- You're about to launch an application and want it reviewed before opening it to the public.
- A client requires a security test as a condition.
- You made significant infrastructure changes and don't know what ended up exposed.
- You want to know whether the measures you already paid for actually stop anyone.
What Waxxor does
We define the scope
We agree in writing which assets are in, which tests are permitted, in what time window and with what authorizations. Nothing is tested outside what was agreed.
We run the tests
We work on the authorized assets, documenting what is found and how it was found.
We deliver the findings
A report with the findings, their evidence, their priority and remediation recommendations, plus a session to walk your team through it.
Retesting
Verifying the fixes afterwards can be included in the project or proposed separately. It depends on what is agreed.
What's included and what isn't
What it normally includes
- Scope agreed in writing before we start.
- Execution of the tests over the authorized assets.
- Report with findings, evidence, priority and recommendations.
- A session to explain the results to your team.
What's worth making clear
- Every project is designed with its own scope. Networks, applications, APIs and other assets are not included automatically: they are in only if agreed.
- Retesting can be included in the project or proposed separately, depending on what is agreed.
- A penetration test is not a Red Team exercise. They are different services, with different objectives and duration.
- The report describes the findings within the agreed scope and window. It is not a certification or a security accreditation.
- Timelines, report format and communication during the project are agreed in the proposal.
Who runs the tests
The tests are carried out by team members holding OSCP, CEH and GIAC certifications. The certifications belong to the people doing the work, not to Waxxor as an organization.
Frequently asked questions
Could this take our systems down?
That risk is handled in the scope: we agree which tests are permitted, during which hours and over which assets. Sensitive systems are either excluded or tested under restrictions.
What do I receive at the end?
A report with the findings, the evidence for each one, its priority and remediation recommendations, plus a session to walk through it.
Does it include retesting after we fix things?
It depends on the project. Retesting can be included in the scope or proposed separately; it is stated in the proposal.
Is this the same as a vulnerability scan?
No. A vulnerability analysis identifies known weaknesses. A penetration test attempts to exploit them in a controlled way to show the real impact.
Do you give us a certification at the end?
No. We deliver a technical report of the findings within the agreed scope. Waxxor does not issue security certifications.
See all services
-
Secure email and files
We configure and harden Microsoft 365 to reduce email fraud, improper access and exposure of your files.
-
SentinelOne protection
We implement and configure SentinelOne on your company's computers and servers, and follow up on the alerts.
-
Backup and recovery
Copies of your information protected against modification or deletion, with quarterly restore testing.
-
Security assessment
Three distinct scopes, from a free diagnostic conversation to a technical analysis defined by proposal.
-
Security awareness
Workshops and good practices so your team recognizes and reports fraud attempts, with phishing simulations according to the contracted program.
Shall we define the scope of your test?
Book a conversation at no cost. We look at what you want tested, with what objective and what restrictions have to be respected.
Monday to Friday, 9:00 to 17:00 (Hermosillo time)