Penetration testing with proven impact.
Web and mobile applications, infrastructure, cloud, devices and AI. Every finding is confirmed by exploitation, chained into a realistic attack path and rated on actual impact — senior specialists, standards matched to the target.
We secure the Czech tech companies that made it globally.
What a penetration test is
A penetration test (pentest for short) is a controlled, pre-authorised attack on your systems. A specialist works the way a real attacker would: finds weaknesses, exploits them and follows them as far as they lead. The result is not a list of theoretical risks but a documented account of what an attacker could actually do in your systems, ordered by impact, with a fix for every finding.
Penetration testing at insighti is manual work by senior specialists. We do not sell scanner output. Every finding is confirmed by exploitation, chained with others into a realistic attack path and rated by CVSSv3 on the impact we demonstrated, not on a tool's score. Methodology follows the target: OWASP OTG and ASVS for web applications and APIs, OWASP MASVS/MASTG for mobile, OWASP LLM and Agentic Top 10 for AI systems; infrastructure and cloud are tested as attack paths — what is reachable and where it leads.
When you need a penetration test
Companies come to a penetration test for one of four reasons:
- A customer or a tender requires it. An independent test is often a condition of the contract or of the tender documentation.
- A regulator or an audit requires it. NIS2, DORA, ISO 27001 and PCI-DSS require or expect security testing — the details are in our overview of penetration testing for compliance.
- A major release or change is coming. A new application, a new API, a cloud migration or a change of architecture — a test before go-live costs less than a fix after an incident.
- Something has already happened. After an incident, a test checks whether the attacker has another way in and whether the measures you took will hold.
As routine practice, a penetration test is run once a year and after every significant change to the system.
Penetration test, vulnerability scan or red team?
| Vulnerability scan | Penetration test | Red team | |
|---|---|---|---|
| What it answers | Which known vulnerabilities does the system have? | What could an attacker actually do in the system? | Would your team detect and stop a real attacker? |
| How it works | An automated tool compares the system against known patterns. | A specialist finds weaknesses by hand, exploits them and chains them into an attack path. | A targeted, covert attack simulation against a defined objective, with detection and response put to the test. |
| What you get | A list of findings ordered by the tool's score, unverified. | Verified findings with proven impact, CVSSv3 severity and a proposed fix. | An account of the attack and an assessment of your team's detection and response. |
| When to choose it | Continuous checks between tests. | Before a release, for a customer, a regulator or an audit. | When you have a security team and want to test its readiness. |
A cybersecurity audit is a different service: it assesses whether the required measures and processes are in place. A penetration test verifies whether those measures hold up against a real attack. We do not audit — we test, and our report serves your auditor as evidence.
For DORA-regulated financial entities, the intelligence-led form of a red team exercise is TLPT.
Kinds of penetration tests
What needs testing depends on where your business runs. Pick the target — each area states its scope and standards.
Web applications
Business logic, access control across roles, client-side code. OWASP OTG/ASVS, APIs included.
View scope
Mobile applications
iOS & Android, on the device and the backend.
View scope
Network & infrastructure
External and internal network penetration testing — from the perimeter to Active Directory, including Wi-Fi and ICS/SCADA.
View scope
Red team
Test whether your team would actually detect and stop a real attacker.
View scope
Thick-client applications
Desktop apps — local data, memory, and backend.
View scope
Devices & IoT
Firmware, interfaces, and physical-access scenarios.
View scope
Cloud infrastructure
AWS, Azure & GCP — config, identity, and workloads.
View scope
AI & LLM applications
LLM apps, agents, RAG, MCP tools — what the model can reach and do. OWASP LLM & Agentic Top 10.
View scopePenetration tests also differ in how much the tester is told up front. Black box imitates an outside attacker with no prior knowledge; grey box works with an ordinary user account and gives the most realistic picture in the least time; white box, with documentation and access, allows the deepest coverage. We recommend the approach on the intro call.
How a penetration test runs
We run penetration tests in five steps — from a no-obligation intro call to the retest.
-
Intro call and scope
We walk through your environment and the goals of the test and propose a fixed scope, approach (black, grey or white box) and price. The call is non-binding.
-
Preparation
We confirm the scope in writing and agree the testing window, the points of contact and what happens if we hit a critical finding or traces of a real attack.
-
Testing and exploitation
Specialists look for weaknesses by hand, confirm them by exploitation and chain them into realistic attack paths. On production systems we coordinate with your operations team.
-
Report and handover
The report is peer-reviewed by a second senior tester. We walk you through the results and answer your developers' and administrators' questions.
-
Retest
Once the fixes are deployed, we verify that the vulnerabilities are actually gone.
What you get
A report in four parts: a scope and methodology recap, a management summary with an expert opinion on your security standing, a findings overview sorted by severity, and detailed findings — each with description, impact, CVSSv3 severity, steps to reproduce and a concrete proposed fix.
Want to see what our report looks like? Ask us for a sample report.
Use the test results toward NIS2, DORA, ISO 27001, and PCI-DSS.
How much does a penetration test cost?
Price follows scope — the number of applications, roles and endpoints, hosts and services, or AI entry points — and the depth of the test (an OWASP Top 10 pass vs. full OTG, ASVS level L1–L3). Each area above states its scoping basis; we confirm the exact scope and price on a short call.
How to choose a penetration testing vendor
At first glance, penetration testing quotes differ mainly in price. The differences that matter are elsewhere:
- Manual test, or scanner output? Ask whether the vendor confirms findings by exploitation. A report full of "potential vulnerabilities" is a tool's output, not a penetration test.
- Who will actually do the testing? The tester's seniority decides whether the business-logic and access-control flaws no tool can find get found.
- A named methodology. The scope should follow a recognised standard (OWASP ASVS, MASVS, OTG) so the test is repeatable and comparable.
- A sample report. Ask for one before you order — it shows whether your developers and your auditor will be able to work with the deliverable.
- A retest after the fix. Check that the vendor retests once the fixes are deployed and confirms they work.
- Independence. A vendor who also fixes the flaws it finds is grading its own work. An independent tester recommends the fix and then verifies it.
We hold our own work to the same criteria — and we are happy to go through them with you on the intro call.
Our insight.
The worst holes are rarely in the technology. A password reset built on a random, secret user identifier is sound — until the same identifier turns up in a fringe function of the system.
Frequently asked, always answered.
Do you test production systems, or should a separate instance be prepared?
Either. Production gives the truest picture; a staging instance allows more invasive testing without affecting users. We agree the approach before the start; on production we coordinate timing and your operations team is on standby during the test.
What is the difference between a vulnerability scan and a penetration test?
A scan finds known vulnerabilities by pattern; it cannot combine or exploit them. A penetration test is manual work: findings are confirmed by exploitation, chained into an attack path, and the real impact is demonstrated.
During testing, will any of our services be temporarily unavailable or data damaged?
The goal is not to disrupt service or damage data, and any potentially destructive test is agreed in advance. A system's reaction to an exploit cannot always be predicted, so we coordinate with your operations team and recommend current backups.
How do you scope a project and build a quote?
On a short call we walk through the environment with you — number of applications, roles, hosts or entry points — and propose a fixed scope and price. The call is free and non-binding.
How often should a penetration test be run?
Common practice is once a year and after every significant change — a new release, a change of architecture or a migration. Some frameworks set the frequency outright, for example PCI-DSS (Requirement 11.4) or DORA for systems supporting critical or important functions.
How long does a penetration test take?
It depends on scope: from a few days for a single application to several weeks for a large environment. The exact schedule is part of the quote.
Do we need a penetration test for NIS2?
If you fall under NIS2 — in the Czech Republic, the Cybersecurity Act No. 264/2025 Coll. — you must implement the security measures the law prescribes and be able to show that they work. A penetration test is the most direct technical evidence that they hold up against a real attack. Which obligations apply to you is covered in our overview of penetration testing for compliance.
Let's talk it through.
Tell us what you need tested — we'll set up a no-obligation call and propose a scope.
Book a free consultation ›