Penetration Testing

Find out how your defences hold up against a real attacker. Our Calgary-based ethical hackers test your networks, web applications, cloud and people, and give you a clear, prioritized plan to fix what we find.

A penetration test shows how your security program holds up

A penetration test is a controlled, authorized attack on your organization by our team of ethical hackers based in Calgary, Alberta. We use the same techniques real attackers use to find the weaknesses in your security controls before someone else does, then show you exactly how to fix them.

Penetration testing is an audit of your security program: it tests whether the controls you have in place actually work. The right test depends on how mature that program is and what you most need to know, so we help you choose between black box, grey box and white box approaches, and decide what belongs in scope.

Every engagement is designed to:
  • Find and fix exploitable weaknesses before an attacker does.
  • Show how far a real attack could get, and what it could reach.
  • Give you a prioritized, actionable report that your technical team and leadership can both use.
  • Support compliance and customer requirements such as PCI DSS, SOC 2 and cyber insurance.
  • Measure whether your security program is working, test after test.

What we test

Our penetration testing services

Every engagement is scoped to what matters to you. Most combine several of these, using the black box, grey box or white box approach that fits your program.

Compare black, grey and white box testing

Find the right penetration test and request a quote

Answer a few questions and we'll recommend where to start, which is sometimes a gap assessment rather than a penetration test. Then tell us how to reach you and we'll confirm the scope and send a quote. Prefer to talk it through? Choose the call option below and book a time with us. Every penetration test now includes one year of OrbitalCyber Starter, so you can retest and track fixes after we leave.

Getting started

Answer a few questions so we can check whether a penetration test is the right first step, or skip ahead and book a call.

How would you like to start? (required)

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

Do you follow a cybersecurity framework today? (required)

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

How confident are you in your current security controls? (required)
What you want to learn

Choose what matters most and what you would like in scope.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

What do you most want to learn? (required)

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

What would you like in scope? (required)

Choose all that apply.

Scope details

We quote penetration tests on the number of servers, workstations, OT systems, cloud environments and sites in scope, and on the size of any application. Approximate numbers are fine.

Answer only if you chose “External network (internet-facing systems)” or “Internal network” or “Operational technology or industrial control systems” for “What would you like in scope?”.

Physical and virtual servers, on-premises or in the cloud. Enter 0 if none.

Answer only if you chose “External network (internet-facing systems)” or “Internal network” or “Operational technology or industrial control systems” for “What would you like in scope?”.

Desktops and laptops. Enter 0 if none.

Answer only if you chose “Operational technology or industrial control systems” for “What would you like in scope?”.

Controllers, HMIs, engineering workstations and other operational technology devices. An approximate number is fine.

Answer only if you chose “Cloud: Microsoft 365, Azure, AWS or Google Cloud” for “What would you like in scope?”.

Count each one separately: for example, each Microsoft 365 or Azure tenant, AWS account or Google Cloud organization.

Answer only if your answer to “How many cloud environments are in scope?” is more than 0.

Which cloud platforms are they on?

Answer only if you chose “Social engineering: phishing and vishing” for “What would you like in scope?”.

Which social engineering techniques would you like included? (required)

Choose all that apply. Phishing campaigns typically need to run for one to two months, so our team can make a sufficient number of attempts.

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

Buildings or locations we would test.

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

City and province or country for each site, so we can plan travel.

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

What kind of physical test would you like? (required)

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

Should testing outside business hours be in scope? (required)

Answer only if you chose “Web application or API” for “What would you like in scope?”.

For example: Ruby on Rails with nginx on Ubuntu, or a React front end with a .NET API.

Answer only if you chose “Web application or API” for “What would you like in scope?”.

What kind of application testing would you like? (required)

Choose all that apply.

Answer only if you chose “Web application or API” for “What would you like in scope?”.

Would you like an AI-assisted security analysis of your code? (required)

Answer only if you chose “Static code analysis (SAST): we review the source code for security flaws” for “What kind of application testing would you like?”, or you chose “Yes” for “Would you like an AI-assisted security analysis of your code?”.

A rough estimate is fine.

About you

Who we'll be working with.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

For example PCI DSS, SOC 2, cyber insurance or a customer contract.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

Testing windows, systems that must not be touched, previous test results, or anything else that helps us scope the work.

Answer only if you chose “Skip the questions and book a 45-minute call with us” for “How would you like to start?”.

Choose a time for your call (required)

Times are shown in your time zone. We'll send a Microsoft Teams invitation to your email.

To choose a time without JavaScript, use the booking page.

Our approaches

Black box, grey box and white box testing

The three approaches differ in how much we know about your environment when we start, and in what you learn at the end. Black box and grey box testing usually happen as one engagement: we start from the outside and, if your defences hold, continue from the inside.

Start outside

Black box testing

Best for organizations confident that their security program is mature.

We start with no inside knowledge, like a real attacker: publicly available information, your internet-facing systems and, if you allow it in scope, your people through phishing and vishing. If your perimeter holds, that is a great result, and the engagement continues as a grey box test.

Assumed compromise

Grey box testing

Best for understanding what an attacker could do once inside.

We start with the access a real attacker might gain, such as a standard user account or a device on your network, and find out how far it gets us: privilege escalation, lateral movement, access to sensitive data, and whether your monitoring notices.

Technical review

White box testing

Best for a cost-effective technical look at your security controls.

With full information and access, we run an automation-driven, purely technical assessment of your security controls and configurations. It is our lowest-cost assessment and a fast way to find and fix technical weaknesses.

Network penetration testing

Network penetration testing

A network penetration test looks across your infrastructure as a whole: the many servers, workstations, network devices and services that make up your environment. It shows which weaknesses an attacker could use to get in, and how far they could get once inside.

From the outside

External network testing

We test your internet-facing systems the way an outside attacker would, looking for a way in.

  • Exposed services, open ports and remote access
  • Missing patches and known vulnerabilities
  • Weak or default credentials
  • Misconfigured firewalls, VPNs and email systems

From the inside

Internal network testing

Starting from a foothold inside your network, we find out how far an attacker could move and what they could reach.

  • Privilege escalation and Active Directory weaknesses
  • Lateral movement between systems and network segments
  • Access to sensitive data and critical systems
  • Whether your monitoring and alerting notice us

Web application penetration testing

How web application penetration testing differs from network testing

Your web applications and APIs are where customers log in, data is processed and money changes hands. A network penetration test touches them, but only briefly. Web application penetration testing puts the application, and only the application, under the microscope.

Network penetration testing

Broad: your whole network

A network penetration test covers many hosts and services at once. Each web application is one target among many, so it gets limited time and attention.

  • Exposed services and open ports
  • Missing patches and known vulnerabilities
  • Weak configurations and default credentials
  • Paths between systems and network segments

Web application penetration testing

Deep: one application, every function

Only the application and its APIs are in scope, so every feature, user role and workflow gets far more rigour and detail.

  • Authentication, password reset and multi-factor flows
  • Session management and access control between users and roles
  • Injection, cross-site scripting and other input handling flaws
  • Business logic: abusing how the application is meant to work
  • APIs and the data they expose
  • Testing guided by the OWASP Top 10 and OWASP testing methodology

If an application holds sensitive data or is critical to your business, give it its own web application penetration test. A network penetration test can tell you the application is there and running; a web application penetration test tells you whether someone can break it.

Beyond the network

Cloud and social engineering testing

Cloud penetration testing

More of your environment lives in AWS, Azure, Google Cloud and Microsoft 365 than ever, and a misconfiguration there can expose everything at once. We test your cloud the way an attacker would, within each provider's testing rules.

  • Identity and access: over-privileged accounts and roles, gaps in multi-factor authentication and conditional access
  • Publicly exposed storage, services and management interfaces
  • Tenant and subscription security settings
  • Attack paths between your cloud and on-premises environments

Social engineering assessments

Attackers often target people because it is easier than breaking technology. We test how your team responds to realistic phishing and vishing (voice phishing) attempts, and show you where awareness training will make the biggest difference.

  • Phishing campaigns tailored to your organization
  • Vishing: phone calls posing as IT support, vendors or executives
  • Clear results you can use to target training

Social engineering is often included in a black box test when you allow it in scope, or it can be run as its own assessment. It can also be combined with physical penetration testing.

Physical security

Physical penetration testing

Your network is only as secure as the building it’s in. If someone can walk in, plug into a network port or reach a server room, many of your digital controls stop mattering.

We test whether an intruder could get into your premises, how far they could get once inside, and how your people and procedures respond.

Covert test

As a real intruder would try it

Unannounced to your staff, so you see how your controls and people really respond. Our testers carry a signed authorization letter on site.

Announced walkthrough

An open review of your physical controls

We walk your premises with your facilities and security team and assess the controls together.

Physical testing can also be combined with phishing and vishing as part of a broader social engineering assessment.

  • Entry and access control

    • Tailgating and piggybacking through secured doors
    • Bypassing doors and locks
    • Testing badge readers and cloning access cards (RFID/NFC)

  • On-site impersonation

    • Posing as a contractor, courier or new employee
    • Talking past reception and staff

  • Rogue devices and network access

    • Plugging into open network ports
    • Leaving a device, such as a network drop box or USB, to show what an intruder could reach from inside

  • Security walkthrough and review

    • Cameras, alarms, locks and visitor procedures
    • Clean-desk practices and document disposal
    • Access to server and network rooms

Operational technology and ICS

No-touch and light-touch assessments for operational networks

Controls networks and industrial control systems can't risk the disruption of active scanning or exploitation. For operational technology (OT) environments, we offer no-touch and light-touch assessments that give you a clear picture of your security without affecting operations.

These assessments are common in oil and gas, utilities, manufacturing and other industries that run critical control systems.

No-touch

Network-based analysis of existing traffic and an inventory-based review of what is installed, with nothing sent to your control systems.

Light-touch

Carefully limited, agreed checks added where they are safe, to fill gaps the no-touch analysis cannot answer.

What we look at

  • Network traffic, to map the devices and communication paths that are actually in use
  • An inventory of installed software, firmware and versions
  • Configurations, patch levels and network design
  • Everything documented, with findings prioritized for your operations team
serious IT worker studying data on screen

Reports your team can act on

At the end of every engagement you get a detailed report with clear, actionable findings: what we found, how we exploited it, the risk it poses to your business and how to fix it, prioritized so your team knows where to start.

As a Canadian business, we understand how much your data, reputation and customer trust matter. We focus on outcomes, not just a list of vulnerabilities, so you finish the engagement with a clear path to a more secure organization.

New from November 2026

Included with every penetration test

A year of OrbitalCyber, so the fixes stick

Every penetration test now includes one year of OrbitalCyber, our vulnerability management service, at the Starter level.

Use it to retest as your team works through our findings, confirm each fix with a fresh scan, and keep watching for new vulnerabilities long after our engagement ends.

About OrbitalCyber

OrbitalCyber Starter

One year included

  • Up to 2 sensors for scanning inside your networks
  • Cloud scanners for your internet-facing systems, with 100 cloud scan credits a month
  • Endpoint agents for 10 computers
  • Every finding tracked until a later scan shows it’s fixed, with top fixes ranked by impact
  • TLS/SSL grading and honeypots that alert

OrbitalCyber Starter is normally CA$49 a month.

How we work

Our penetration testing methodology

Every test follows the same six-phase methodology, from planning the attack through to helping your team fix what we find.

  1. Reconnaissance and threat modelling

    We gather information and model the threats that matter to you before planning the attacks we will use in the test.

  2. Enumeration

    The information from reconnaissance is used to identify possible entry points into your systems.

  3. Exploitation

    We actively attempt to exploit the weaknesses we identified to achieve the goals agreed with your stakeholders.

  4. Risk assessment

    We assess the risk from critical vulnerabilities, successful exploits and your security practices, and identify the policy and control improvements that will reduce it.

  5. Reporting and advice

    Your report explains each vulnerability we found, with step-by-step guidance on how to fix it.

  6. Remediation and validation

    We work with your IT provider or internal team on remediation, then validate the fixes with you. Your included year of OrbitalCyber lets you keep retesting and tracking fixes after we leave.

Contact us to discover how our penetration testing services can give your business the protection and confidence it deserves.

Let's Get Started

Not ready for a pen test?

Start with a gap assessment

If you aren’t sure what security controls you have, or have low confidence in them, a penetration test of your networks or cloud isn’t the best first step. A gap assessment measures your program against the framework you want to meet and gives you the plan and roadmap to get there.

About gap assessments

A penetration test audits your security program. A gap assessment helps you build it.