Cloud Penetration Testing
Manual testing of your AWS, Azure or GCP environment for exploitable misconfiguration and privilege-escalation paths.
Services
Penetration testing services.
Nine engagement types across applications, APIs, AI systems, cloud, infrastructure and compliance. Every engagement is scoped in writing before it starts, run by a certified operator, and closed with a retest. Based in Dhaka, we are a penetration testing company in Bangladesh providing VAPT services across Bangladesh and worldwide.
Scope an engagement →Application security
Web Application Pentest
Grey-box testing with credentials for every role you want covered. Business logic and access control get the same attention as the injection classes a scanner finds.
- Scope
- Authenticated and unauthenticated paths, each user role and tenant boundary, session handling, password reset and MFA flows, file upload and export, and any admin surface you include.
- Method
- OWASP WSTG, with manual exploitation and chaining. Scanner output is used for coverage, never reported without validation.
- Deliverable
- Findings rated with CVSS v3.1, each with reproduction steps, request and response evidence, and remediation notes written for engineers. One retest after fixes.
Application security
Mobile Application Pentest
Android and iOS builds tested as a whole system: the compiled app, what it writes to the device, and the backend it talks to. Also offered as mobile app penetration testing in Bangladesh.
- Scope
- Static and dynamic analysis of the build, local storage and keychain use, certificate pinning and traffic interception, IPC, deep links and exported components. Backend APIs included by agreement.
- Method
- OWASP MASVS on rooted and jailbroken devices, plus a stock device where a control only holds on unmodified platforms.
- Deliverable
- One report per platform, with the device and OS version each finding was reproduced on. Retest after fixes.
Application security
API Pentest
REST, GraphQL and service-to-service interfaces tested against their real behaviour, including endpoints the specification does not mention. Also offered as API penetration testing in Bangladesh.
- Scope
- Object and function level authorisation per role, authentication and token handling, mass assignment, injection, rate limiting and resource consumption. GraphQL introspection, depth and batching where applicable.
- Method
- OWASP API Security Top 10. The provided OpenAPI or GraphQL schema is reviewed first, then compared against what the API actually accepts.
- Deliverable
- Findings with the exact requests that reproduce them, ready to replay. Retest after fixes.
AI security
AI & LLM Pentest
Model-backed features tested as attack surface: the prompts, the tools the model can call, the data it retrieves, and the agents that chain them.
- Scope
- Direct and indirect prompt injection, system prompt extraction, tool invocation and excessive agency, retrieval and embedding poisoning, output handling in downstream systems, and cost or quota abuse.
- Method
- OWASP Top 10 for LLM Applications and MITRE ATLAS, tested against the running application rather than the model in isolation.
- Deliverable
- Findings with the prompts and payloads that trigger them, and the downstream impact each one produced. Retest after fixes.
Infrastructure
Network & Infra Pentest
External or internal, or both. The goal is the path from one exposed service to the access that actually matters.
- Scope
- Host and service discovery, patch and configuration weaknesses, default and reused credentials, network segmentation, and privilege escalation and lateral movement from an assumed foothold.
- Method
- NIST SP 800-115 and PTES. Exploitation is agreed in the rules of engagement before testing starts.
- Deliverable
- Findings with affected hosts, the path taken, and remediation ordered by what closes the most exposure. Retest after fixes.
Adversary simulation
Red Teaming Exercises
An objective-led exercise against your live environment. It measures detection and response as much as exploitability, so it suits teams that already run a SOC.
- Scope
- Agreed objectives such as reaching a system, a dataset or a level of access. Initial access, persistence, privilege escalation and exfiltration paths, within the constraints set in the rules of engagement.
- Method
- Techniques mapped to MITRE ATT&CK. Every action is timestamped and logged so your team can reconstruct the timeline afterwards.
- Deliverable
- Attack narrative with the ATT&CK mapping, a detection gap analysis against what your tooling recorded, and a purple team debrief.
Continuous assurance
Vulnerability Assessment
Breadth over depth. Useful when you need regular coverage of a large estate rather than deep exploitation of one application.
- Scope
- Authenticated and unauthenticated scanning across the hosts and applications in the agreed inventory, on a one-off or recurring schedule.
- Method
- Automated scanning with manual triage. Every finding is verified by an operator before it reaches you, so false positives do not become tickets.
- Deliverable
- Prioritised findings with CVSS scores, plus a comparison against the previous cycle showing what was fixed, what regressed and what is still open.
Cloud
Cloud Security Audit
Six engagement types across your cloud provider, deployment pipeline and container platform, run by the same certified operators as every other engagement.
Cloud Security Assessment
A configuration review against your provider's security benchmark, covering IAM, storage, networking and logging.
CI/CD Pipeline Security Assessment
Testing of the build and deployment pipeline itself — secrets handling, runner permissions and supply-chain exposure.
Container Security Assessment
Image and runtime review covering base-image vulnerabilities, privilege escalation and container escape paths.
Kubernetes Security Assessment
Cluster configuration review — RBAC, network policy, secrets and the control plane's exposed surface.
Microservices Penetration Testing
Service-to-service testing across your microservices architecture, including inter-service authentication and trust boundaries.
Compliance
Compliance Readiness Assessment
Five engagement types built around the evidence your auditor or assessor actually asks for, run by the same certified operators as every other engagement.
PCI DSS Penetration Testing
Testing scoped to Requirement 11.3, covering the cardholder data environment and any system connected to it.
ISO 27001 Security Assessment
A technical readiness check against Annex A controls ahead of certification or a surveillance audit.
SOC 2 Security Testing
Evidence-generating testing mapped to the Security and Availability trust service criteria your auditor will ask for.
HIPAA Security Testing
Testing focused on systems that store, process or transmit ePHI, aligned to the HIPAA Security Rule.
Compliance Gap Assessment
A framework-agnostic review that flags the gaps between your current controls and the standard you are working towards.
FAQ
Choosing the right engagement
Which security test does my organisation need?
It depends on what you are protecting and what you need to prove. Web, mobile and API pentests target a specific application and the roles inside it; a network and infrastructure pentest follows the path from an exposed service to meaningful access; a vulnerability assessment gives recurring breadth across a large estate; and a red team exercise measures whether your team detects and responds. Compliance readiness work is scoped around the evidence an auditor asks for.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment is breadth over depth: authenticated and unauthenticated scanning across an agreed inventory, with every finding verified by an operator before it reaches you, and a comparison against the previous cycle showing what was fixed, what regressed and what is still open. A penetration test goes deep on one target, with manual exploitation and chaining rather than scanner coverage. Many organisations run both.
When should we choose a red team exercise instead of a penetration test?
Choose a red team exercise when you want to measure detection and response, not just exploitability. It is objective-led — reaching a system, a dataset or a level of access — with techniques mapped to MITRE ATT&CK, every action timestamped, and a detection gap analysis against what your tooling actually recorded. A penetration test is the better choice when the goal is finding and fixing weaknesses in a defined scope.
Do all engagements produce the same kind of report?
No. The deliverable matches the work. An application pentest returns findings rated with CVSS v3.1, each with reproduction steps and request and response evidence. A vulnerability assessment returns prioritised findings plus a cycle-on-cycle comparison. A red team exercise returns an attack narrative with ATT&CK mapping, a detection gap analysis and a purple team debrief. Every engagement is closed with a retest.
How often should we run security testing?
That depends on how often your systems change. A one-time pentest suits a release or a compliance milestone; a vulnerability assessment runs on a recurring schedule when you need regular coverage of a large estate; and PTaaS fits teams shipping frequently, testing each release rather than once a year. Whichever you choose, scope is agreed in writing before testing starts.
We have several systems — does that mean several separate engagements?
Not necessarily. Scope is agreed in writing before an engagement starts, so related surfaces can be covered together — a web application and the API behind it, for example. Cloud work spans six engagement types across the provider, pipeline and container platform, and compliance readiness covers five built around PCI DSS, ISO 27001 and SOC 2 evidence. For a continuously changing estate, PTaaS covers the surface across releases.
Define the scope of your security assessment.
Scoping, testing and the retest all run from our Dhaka-based security team.