Penetration Testing and Security Audit in Romania

What we attack, and how

We test what really runs on your plan: the web application, public APIs, admin panels, the server and the network around them. Web targets are measured against the OWASP Top 10 and APIs against the OWASP API Top 10. The host is checked for exposed services, outdated versions and loose file permissions. Tests run in a window agreed with you, so production traffic is not disturbed, and each result is reproduced manually before it is written down.

• Authenticated and unauthenticated web and API testing
• Business logic: carts, payments, quotas, roles and tenant isolation
• Servers, containers and services reachable from the internet
• Privilege escalation and lateral movement inside the network
• Review of backups and administrative access

Why AI shortened your window

Attackers no longer probe by hand. LLM agents read a freshly published CVE, write an exploit and try it across the internet within hours, so the gap between disclosure and first attack has collapsed and a yearly pentest leaves long blind spots. We use the same tooling on your side: automated reconnaissance, assisted fuzzing and triage that groups hundreds of signals into a few hypotheses. A person then proves each one, because a convincing agent report is not the same thing as a demonstrated risk.

What the report contains

The report is written in English or Romanian: an executive summary, technical detail with reproduction steps, a CVSS rating, an EPSS-based priority and remediation advice fitted to your real configuration. Once your team has fixed the issues we retest and add the proof. If you fall under NIS2, transposed in Romania by OUG 155/2024 and DNSC orders, the technical file helps in an audit. The formal audit is signed by a DNSC-authorised auditor from the public list; we supply the technical part and the evidence.

How a test fits your plan

You request the work from the DevOps Services section of the client panel and propose the date. A focused test of a small application, a retest round or the fixing of what we found usually fits the monthly hours in your plan: 1 h on cPanel from Advanced up, 1–8 h on VPS, 5–10 h on dedicated servers depending on the plan, and 10 h on GPU servers. A full pentest of an estate with many APIs goes beyond that, and the extra hours are billed separately once you accept the estimate. Hours do not carry over.

How we work

1. Request from the panel

   Open a request in the DevOps Services section of the client panel, name the targets (domains, APIs, servers) and propose the delivery date that suits you.

2. Scoping and test window

   We agree the perimeter, test accounts, intensity and execution window together, and confirm in writing what is in scope and what stays outside it.

3. Testing and live alerts

   We test manually and with automated tools, reproduce every result and warn you at once if something critical turns up, without waiting for the final report.

4. Handover and retest

   You receive the report, we walk through the priorities, help with fixes from the included hours and retest what was repaired, attaching proof.

Use cases

Technology stack

• Burp Suite
• OWASP ZAP
• Nmap
• Nuclei
• sqlmap
• Metasploit
• Semgrep
• Trivy

Frequently asked questions

• How much does a penetration test cost in Romania?

  We do not publish rates on this page. Every plan includes monthly CyberSecurity hours, and a focused test often fits inside them: 1 h on cPanel from Advanced up, 1–8 h on VPS, 5–10 h on dedicated servers depending on the plan, 10 h on GPU. Anything beyond is billed separately, only after you accept the estimate. Plan details are on the pricing page.

• How long does a penetration test take?

  It depends on the perimeter. A small web application is covered quickly, while an estate with several APIs and separate environments takes longer. We fix the duration at scoping, together with the test window, and tell you beforehand whether the work fits the included hours or not.

• Penetration test or vulnerability scan: which one do I need?

  A scan runs often and finds what is already known: old versions, wrong settings, published CVEs. A pentest looks for what signatures cannot see: broken business logic, wrong permissions, chains of small flaws. We suggest continuous scanning all year and a pentest before big releases or when an audit asks for one.

• Can AI replace a human penetration tester?

  No. AI agents speed up reconnaissance, fuzzing and triage, but they also produce plausible results that do not hold up. We use them to cover more surface, then validate each finding by hand and deliver it with reproduction steps. A person stands behind every line of the report.

• Do I need a pentest for NIS2, ISO 27001 or a customer audit?

  A pentest is common technical evidence for NIS2 obligations under OUG 155/2024, for ISO 27001 alignment and for customer security questionnaires, but none of them is met by a pentest alone. The formal NIS2 audit is signed by a DNSC-authorised auditor; we provide the technical part and the proof.

• How often should a penetration test be repeated?

  At least after every major change: a new application version, an infrastructure migration or a payment integration. Between tests, continuous scanning and EPSS-based prioritisation cover newly published vulnerabilities, which attackers now exploit automatically within hours of an announcement.