Enterprise Penetration Test2021-06-24T12:39:35+00:00

Penetration Testing for Enterprise Companies

PreCog Security’s penetration testing approach is focused on optimizing the conducted tests and the time that is available to uncover security vulnerabilities in the testing object.

We custom our testing to discover vulnerabilities that have the most potential risk and impact, regarding a possible threat scenario, optimized for the ease of discovery by a third party. This helps us discover vulnerabilities that have the biggest possible damage on the system but are practical and realistic according to the threat model of the testing object.

Our penetration testing steps include the following:

  • pre-engagement interactions
  • intelligence gathering
  • threat modeling
  • vulnerability analysis
  • exploitation
  • post exploitation
  • reporting

PTES Testing Guide

The Penetration Testing Execution Standard document defines the methods and process of executing a network penetration test. The guideline is designed to provide a common language and scope for performing penetration testing, as well as detailed technical guidelines, to both businesses and security service providers. For additional information, please refer to:

Learn more

OWASP Testing Guide

The Open Web Application Security Project’s Testing Guide document defines the industry best practice web application penetration testing methodology. The value in using this document as a reference on the possible prevalence, exploitability, impact and detectability of a particular class of vulnerabilities, helps us focus on finding the most prevalent and detectable vulnerabilities that could have the most significant security impact. For additional information, please refer to:

Learn more

Do you have an Information
Security Policy?

Learn more

PreCog Security network penetration testing methodology and categories summary:


Pre-engagement Interactions

  • Scope and Rules of Engagement Definition
  • Communication Planning
  • Incident Handling


  • Network Probing and Footprinting
  • User and Service Enumeration
  • Domain Resource Enumeration

Vulnerability Discovery and Analysis

  • Vulnerability Scan
  • Vulnerability Validation


  • Network Traffic Sniffing, Relaying and Impersonation of Services
  • Exploitation of Vulnerable Services
  • Escalation of Privileges
  • Pivoting to Critical Systems

Configuration Audit

  • Infrastructure Analysis
  • Configuration Analysis
  • Data Discovery
  • Password Audit
  • Group Policy Audit


  • Executive Summary
  • Detailed Findings Report

Enterprise Questionnaire


1 / 10

Do you have a prepared and tested Business Continuity/Disaster Recovery plan?

2 / 10

Do you have a prepared and tested Incident Response Plan (including handling, monitoring and reporting of the incident)?

3 / 10

If you are developing in software/applications, have you implemented a secure software development lifecycle?

4 / 10

Are you performing vulnerability assessments, penetration testing and vulnerability management on information system assets (network, website, endpoints, servers, software, web applications, etc)?

5 / 10

Are you performing regular inventory of all IT assets (hardware and software)?

6 / 10

Are you following a formal configuration management, patching and change control process?

7 / 10

Do you have a documented and standardized process for hardening systems and hosts, and is this process automated via a configuration management system?

8 / 10

Do you actively manage supply chain security risk and enforcing third party risk management?

9 / 10

Are you employing anti-malware and other security controls such as firewall, data loss prevention, intrusion detection/prevention systems across your environment?

10 / 10

Do you collect, monitor and analyze yoursystem, application and security logs in a dedicated, secure, centralized logging solution or a security monitoring system?

PreCog Security web application penetration testing methodology and categories summary:

PreCog Security follows OWASP (Open Web Application Security Project’s) Testing Guide document defines the industry best practice web application penetration testing methodology. The methodology is detailed and outlines 91 tests in a total of 11 categories:

  1. Client Side Testing
  2. Business Logic Testing
  3. Cryptography
  4. Authentication Testing
  5. Authorization Testing
  6. Session Management Testing
  7. Input Validation Testing
  8. Error Handling
  9. Identity Management Testing
  10. Configuration and Deployment Management Testing
  11. Information Gathering

Depending on the available time for the test, we optimize to run tests that would have the most significant impact and could be discovered easily by an attacker. To read more about the OWASP Testing guide and the application penetration testing methodology, please refer to:

OWASP Testing Project