PENETRATION TESTING – PENTEST

We offer various approaches: external, internal, black-box, or white-box penetration testing…

Test your network's level of resilience against cyberattacks from the Internet or internally, whether by malicious personnel, an intern, etc.

Our approach to penetration testing

Black-box penetration testing simulates an attacker who decides or is tasked with "attacking" you. We begin the penetration test with minimal information, work to identify a perimeter, and then validate the identified assets with you before launching more aggressive tests.

During a white-box penetration test, you provide us with complete details of the perimeter right from the start of the engagement.

Learn more

Key strengths of our penetration tests

For security audit operations, ITrust deploys experienced auditors who have also led study, deployment, and operational transition projects for technical infrastructures. These consultants are true industry practitioners—engineers initially trained in technical infrastructure fields who can formulate real-time diagnostics of technical flaws, immediately provide architecture recommendations, and propose technical remediation or workaround solutions. Generally speaking, our approach compiles audit best practices: OSSTMM for the network and systems scope, and OWASP for the web application scope. ITrust is a co-founder of the FPTI (French Federation of Penetration Testing Professionals).

External penetration testing

A penetration test aims to evaluate the exposure of your infrastructure on the Internet, determine the resilience level of your information system against attacks originating from the Internet or internally, and provide a comprehensive set of recommendations designed to enhance your security posture. To achieve this, security engineers specifically attempt to access allegedly sensitive or confidential data. External penetration testing is conducted in optimized, successive phases based on the expertise and experience of ITrust consultants, leveraging a methodology proven since 2007 and applied across more than 500 audits:

Discovery and identification of the Internet interconnection network topology: IP address and application port scans, architecture profiling.
Information gathering and vulnerability discovery: Identification of operating system and application versions, known vulnerability identification, zero-day/unknown vulnerability discovery, development of exploit scenarios for identified flaws.
Vulnerability exploitation and intrusion attempt: Execution of exploit scenarios, pivoting toward other systems using acquired data and privileges (e.g., access to an administrator account).
Impact analysis of exploited vulnerabilities: Classification according to their exploitability.
Remediation roadmap and countermeasures: Estimation of implementation timelines and costs.

Internal penetration testing

An internal penetration test aims to evaluate your network's resilience against attacks conducted from within the environment. To accomplish this, security engineers specifically attempt to gain access to allegedly sensitive or confidential data.

By provisioning a privileged account on the network, testing can yield configuration and installation details from target machines, thereby providing a more thorough assessment of the audited network's security level.

Also referred to as a user account audit, internal penetration testing measures the potential for insider threat damage: scenarios involving malicious personnel or malware-compromised workstations.

Independence, ethics, and continuous skill development

To guarantee impeccable service quality and complete independence from third-party vendors and external service providers, ITrust ensures:

Total independence from third-party vendors and service providers

Defined and implemented rigorous quality requirements

Active participation in ISO 27001, EBIOS, and RGS working groups

Attendance at industry conferences as both exhibitor and speaker

Strong commitment to the PASSI framework and Critical Infrastructure Operators (OIV)

As part of safeguarding French information assets and industrial leaders, ITrust is committed to certification processes aligned with ANSSI
– CSPN for the development of its IKare tool (security posture evaluation, vulnerability assessment, asset management),
– PASSI for its professional services.

ITrust notably holds the France Cybersecurity label.
Our capital is exclusively French.
Our engineers are exclusively based on French territory.

ITrust has a formal code of ethics

ITrust abides by a code of ethics stipulating, among other requirements, that:

– Audit engagements are performed with loyalty, discretion, impartiality, and independence;
– Auditors rely exclusively on methods, tools, and techniques approved by ITrust;
– Auditors undertake not to disclose any information obtained or produced during audits—including to other auditors not assigned to the engagement—unless authorized by the client;
– Auditors promptly report any manifestly illicit content discovered during an audit to the client;
– Auditors commit to complying with applicable laws, regulations, and audit best practices (ISO 19011);
– All auditors sign the code of ethics.

Quality above all

Our engineers are senior specialists selected to be part of the ITrust RedTeam (Expert Team). All hold permanent contracts (CDI) and are based in France. We strictly refrain from subcontracting to external engineers, except under extraordinary circumstances and with our clients' explicit prior approval.

Our clients say it best:

Air France regularly has its information system and web portals audited by various firms. ITrust stepped in and detected critical security vulnerabilities that had gone unnoticed in previous years! We were immediately convinced. Their team fully mastered the company's international environment.

T.R., CISO, Air France

Credit.fr is a crowdfunding platform providing loans to SMEs. We selected ITrust during the launch of this platform. Handling confidential data made delivering a highly secure service to our clients imperative.
Throughout this engagement, we particularly valued the responsiveness and thoroughness of ITrust's teams, who successfully reassured us regarding the platform's high level of security and provided actionable improvement recommendations.

Laurent De Bernede, Co-Founder of Credit.fr

MTarget provides mobile services worldwide. ITrust enabled us to secure our information systems cost-effectively. We began with an intrusive audit. We were thoroughly impressed by their technical excellence and professionalism.

F. Mussot, Founding President, MTarget

Contact us

An initial discussion with our team will allow us to thoroughly understand your objectives and provide you with a tailored quote for our Dark Web monitoring solution