SysAlbania offensive security

We break it before
someone else does

Penetration testing and incident response for teams that ship fast. Fixed scope, evidence in every finding, retest included.

Book an assessmentSee what we test
engagement -- recon phase
$
Web applicationsInternal networksCloud (AWS, Azure)APIsActive DirectoryMobile apps

What we do

Four engagement types. Each one is fixed scope and fixed price, quoted before work starts.

Penetration Testing

Manual testing of your web applications, APIs and internal networks against the same techniques a real attacker would use, with every finding evidenced and rated.

Read more

Security Audit

A configuration and architecture review across cloud, identity and network, checking what is actually deployed against what your policies claim.

Read more

Incident Response

Containment, forensics and recovery support when something has already happened, available ad hoc or on a pre-agreed retainer.

Read more

Security Advisory

Ongoing security guidance for teams without a full-time security hire, covering architecture review, vendor assessment and policy work.

Read more

How an engagement runs

No surprises. You know the scope, the window and the price before we start.

  1. 01

    Scope

    We agree targets, rules of engagement and a testing window in writing before anything is touched.

  2. 02

    Test

    Manual testing against the agreed surface, backed by tooling. You get a same-day call if we find something critical.

  3. 03

    Report

    Every finding carries reproduction steps, evidence and a CVSS rating, written so a developer can act on it.

  4. 04

    Retest

    Once you have fixed the findings we verify each one and reissue the report. Included, not billed separately.

What lands in your inbox

A report your developers can act on, not a tool dump with a logo on the cover.

  • Executive summary written for non-technical stakeholders
  • Every finding with reproduction steps, evidence and CVSS rating
  • Same-day disclosure call if anything critical surfaces mid-test
  • Remediation retest and a reissued report, included
report -- findings summary
$

Common questions

How long does a penetration test take?

A typical web application test runs five to ten working days including reporting. Scope drives the number, and we confirm it in writing before starting.

Do you need production access?

Not usually. Most tests run against a staging environment that mirrors production. Where production testing is genuinely required we agree a window and a rollback plan first.

What do we receive at the end?

A written report with an executive summary, every finding with reproduction steps and CVSS rating, and a remediation retest once fixes are in place.

Is retesting included?

Yes. Verifying that a fix actually works is part of the engagement, not a separate invoice.

Find out what an attacker would find

Tell us the target and the deadline. You get a fixed quote within two working days.

Book an assessment