---
title: "Penetration testing"
url: "https://unshade.pl/en/services/penetration-testing"
lang: "en"
summary: "A controlled attack on your applications, APIs and network — with proof of exploitation."
---

# Penetration testing

We simulate a real attack on your systems. We test manually, chain vulnerabilities into attack paths and document every step.

## What we test

- Web applications and APIs (REST, GraphQL)
- iOS and Android mobile apps
- External infrastructure and perimeter
- Internal network and Active Directory
- Wi-Fi networks

## What you get

- Executive summary
- Findings with PoC and CVSS scores
- Step-by-step remediation guidance
- Results walkthrough meeting
- Retest and final report

## What to know about penetration testing

Penetration tests are controlled, safe attempts to break through the security of IT systems and applications. The goal is to find weaknesses and assess their impact on your organisation. Unlike real attacks, our tests run under full control, and all data and information stay strictly protected.

They are an essential part of an effective cybersecurity strategy: they help detect and eliminate vulnerabilities before cybercriminals do. With growing threats and regulatory requirements such as NIS2 and DORA, regular testing protects against attacks and supports compliance with applicable standards.

## What you gain

- **Verified protection** — we find the weak points before cybercriminals do, so your organisation keeps running without disruption.
- **Regulatory compliance** — NIS2, GDPR, DORA, PCI DSS and ISO 27001 require systematic security measures, including penetration testing.
- **Business continuity** — early identification and remediation of vulnerabilities prevents outages in critical business processes.
- **Protected data and reputation** — a lower risk of data leaks, costly incidents and negative publicity.
- **Awareness in the organisation** — your IT team learns about real threats and the areas that need improvement.
- **Detailed recommendations** — every report contains clear, practical guidance tailored to your system.

## Types of tests

We offer four types of penetration tests, matched to different attack scenarios. We pick the variant for the goal of the test; grey box usually gives the best coverage for the time.

- **Black box** — simulates an intruder with no knowledge of the system. Shows how well external application interfaces and public services are protected against threats from the Internet.
- **Grey box** — black box plus partial knowledge of the system, e.g. technical documentation or test accounts. Gives a better understanding of the architecture and pinpoints vulnerabilities available to someone with limited knowledge of the environment.
- **White box** — full access to source code, documentation and architecture. Enables in-depth analysis and finds vulnerabilities that are hard to detect any other way.
- **“Slow” (long-term) tests** — simulates an attacker who spreads activity over time to stay unnoticed. Evaluates threat detection (SIEM) and incident response (SOC).

## Support and retesting

Our collaboration does not end with the report. We walk your team through the findings, help implement the fixes and verify them with follow-up tests — until the system is fully secured.

## What our clients say

> The Unshade team are true professionals in their field. Thanks to their knowledge and commitment, we were able to significantly improve the security of our applications. We recommend their services to anyone who values quality and reliability.
> — Donata Basińska, Vice President, WebTailor

> Unshade are experts you can rely on. Their knowledge, precision and dedication allowed us to ensure the highest level of security for our client's systems. I recommend their services to anyone looking for a solid partner in penetration testing.
> — Michał Mikołajczak, CEO, DataRabbit

> Unshade is a reliable and professional partner that conducted penetration tests and IT security workshops for us at the highest level. The team's expert knowledge and meticulousness resulted in a real strengthening of our systems' security. We fully recommend their services.
> — Piotr Goździejewski, Head of DevSecOps, e-file

## Blog

- [120 minutes that can save your company – a cybersecurity awareness training](https://unshade.pl/en/blog/120-minutes-that-can-save-your-company.md)
- [PBKDF i bcrypt](https://unshade.pl/en/blog/pbkdf-and-bcrypt.md)
- [How to Bypass AMSI? My Experience with PowerShell Bypassing](https://unshade.pl/en/blog/how-to-bypass-amsi.md)
- [Bcrypt Cocktail and Hash Extraction](https://unshade.pl/en/blog/bcrypt-cocktail-and-hash-extraction.md)
- [Sacrificial session](https://unshade.pl/en/blog/sacrificial-session.md)
- [Hash function](https://unshade.pl/en/blog/hash-function.md)
- [Introduction to Password Cracking #3 Rules](https://unshade.pl/en/blog/introduction-to-password-cracking-3-rules.md)
- [Introduction to Password Cracking #1 Intro](https://unshade.pl/en/blog/introduction-to-password-cracking-1-intro.md)
- [Introduction to Password Cracking #2 Wordlists](https://unshade.pl/en/blog/introduction-to-password-cracking-2-wordlists.md)
- [CrackMeIFYouCan 2022 DEFCON Writeup](https://unshade.pl/en/blog/crackmeifyoucan-2022-defcon-writeup.md)

## Request an anonymised report

See what our penetration test report looks like: the structure, findings with PoC, CVSS ratings and recommendations. We send an anonymised version to your work email.