Penetration testing in Belgium
I attack your systems the way a real attacker would, within agreed rules, to find your weaknesses before they do. And because I spend my days on incident response, I test what attackers actually use.
What I test
- External exposure: everything reachable from the internet
- Internal network and Active Directory: what an attacker can do once inside
- Web applications and APIs
- Wi-Fi networks
- Cloud environments: Microsoft 365 and Azure
- Physical intrusion and social engineering
How I work
- 01
Scoping
We agree on the targets, the type of test, the timing and the rules of engagement.
- 02
Reconnaissance
Mapping what an attacker would see: exposed services, accounts, technologies.
- 03
Exploitation
Exploiting the weaknesses found, safely, to prove their real impact.
- 04
Post-exploitation
How far can an attacker go: privilege escalation, lateral movement, access to sensitive data.
- 05
Report and debrief
A clear report with risk-rated findings and fixes, and a debrief with your team. A retest of the fixes can be planned.
What you get
- An executive summary for management
- Technical findings rated by risk, with evidence and steps to reproduce
- Concrete, prioritised remediation
- A debrief with your technical team
Why Cyber Horizon
- GIAC Penetration Tester (GPEN) and Experienced Penetration Tester (GX-PT)
- Hack The Box CPTS, Red Team Operator (CRTO) and wireless pentesting (GAWN)
- Incident response experience: I know which weaknesses attackers really exploit
- Recommendations that include detection, not only patching
Frequently asked questions
What is the difference between a vulnerability scan and a pentest?
A scan lists potential vulnerabilities automatically. A pentest is carried out by a person who exploits them and chains them together, to show what an attacker could really achieve.
Will the test disrupt our business?
Tests are planned with you, and risky actions are agreed beforehand. Most tests run without any impact on production.
How long does a pentest take?
From a few days to a few weeks, depending on the scope. After the scoping call, you receive a proposal with the duration and the price.
Black box, grey box or white box?
It depends on your goal. Grey box, with limited information such as a standard user account, usually gives the best value for the time spent.
Do you test mobile applications?
No. Mobile application testing is not part of my services.