OWASP WSTG & PTES Methodology
Find the Way In Before Someone Else Does
Structured testing of your infrastructure, applications and people. With CVSS-rated findings, reproduction steps, and a retest that proves the gaps are closed.
The problem
A Scan Is Not a Test
Most companies have run a vulnerability scan. It produced a long PDF of “medium” findings, nobody owned it, and nothing changed. Scanners are good at one thing: listing known vulnerabilities. They cannot tell you which ones matter.
An attacker doesn’t work from a list. They chain three unremarkable findings — an exposed service, a reused credential, an over-permissioned account — into domain admin. That path is what you need to see, and no scanner will show it to you.
Our approach
Scoped, Chained, Retested
We test the way an attacker works: enumerate, chain, escalate — inside a scope we agree in writing before anything starts. You get findings rated by CVSS with reproduction steps a developer can follow, and a management summary that needs no translation.
Then we retest once you’ve remediated. That second pass is what turns a penetration test from an interesting read into evidence — the thing your auditor, your insurer and your enterprise customer are actually asking for.
How It Works
01
Scoping & Rules of Engagement
Targets, testing windows, and what is explicitly out of scope.
Rules of engagement in writing, signed by both sides.
Named escalation contact, reachable for the duration.
Black-box, grey-box or white-box — chosen for what you need to learn.
02
Testing
External and internal infrastructure: exposed services, segmentation, patch levels.
Web applications and APIs against the OWASP Testing Guide.
Active Directory: credential hygiene, privilege paths, lateral movement.
Social engineering and phishing, where the scope includes people.
03
Reporting
Every finding rated by CVSS, with the reasoning shown.
Reproduction steps precise enough for your developers to verify.
Attack paths documented end to end, not just isolated findings.
Management summary written for people who won’t read the technical section.
04
Retest & Evidence
Retest of every finding you report as remediated.
Closing report stating what was fixed and what remains accepted.
Suitable as evidence for ISO 27001, NIS2, TISAX and customer questionnaires.
Findings tracked in your GRC workspace if you run Managed GRC with us.
How we deliver
No Surprises, By Design
Availability comes first. We stop and call you before doing anything that could affect production, and the rules of engagement say so in writing. No test is worth an outage you didn’t agree to.
You receive:
Rules of engagement agreed and signed before testing.
Findings report with CVSS ratings and reproduction steps.
Management summary for the board and for procurement.
Retest and closing report once remediation is done.
Who it’s for
Ideal For:
Companies with a standard to satisfy: ISO 27001, NIS2 or TISAX expects technical testing, and a scan won’t close it.
SaaS and software vendors: whose enterprise customers ask for a current test report before signing.
Anyone who has only ever scanned: and wants to know what an attacker would actually do with the results.
Teams after an incident: who need to know whether the way in is really closed.
Why Invest in This?
Impact 01
Audit Evidence
ISO 27001, NIS2 and TISAX all expect technical security testing. The retest report is the artefact that closes the requirement.
Impact 02
Real Attack Paths
A scanner lists known vulnerabilities. A tester chains them together. The difference is whether you learn how you would actually be breached.
Impact 03
Customer Confidence
Enterprise procurement increasingly asks for a current penetration test report before signing. Having one shortens the deal, not just the audit.
Tracer
by Vective
Between the tests,
Tracer keeps checking.
This service shows where you stand today. Tracer, our continuous security assurance, keeps finding and proving the ways in between engagements, re-checks every fix and keeps the evidence your auditors ask for.
Scoped to your situation.
Not to a price list.
Penetration Testing
Scoped test, CVSS-rated findings and a retest
Format: remote, with on-site work where internal testing requires it.
Scope: external/internal infrastructure, web apps and APIs, Active Directory, optional social engineering.
Duration: typically one to three weeks of testing, depending on scope.
Deliverables: findings report, management summary, retest and closing report.
Included: one retest of remediated findings.
Questions,
answered.
Anything else on your mind? Ask us directly, we are happy to help.
How is this different from a vulnerability scan?
Will it take our systems down?
Do we get a report we can hand to an auditor or a customer?
How does this relate to your AI Red Teaming?
That’s not all.
More ways we can help.
TÜV-certified AI Expert & Practical Practitioner Expertise
AI Agent Development for Software Teams
A 3-day deep dive transforming developers into AI engineers. Build functional RAG prototypes and production-ready code.
ISO 27001 Aligned Methodology
AI Agents & Secure Automation
Master Agentic AI & Sovereign Automation. Learn to build secure AI agents using Pything, n8n, Dify and more in this advanced 4-hour Vective workshop. Stop chatting, start building.
TÜV-certified AI Consultant
AI Potential Analysis & Strategy Workshop
Transform your team from AI experimenters to AI strategists in one day. Includes 3 prioritized use cases and a 6-month roadmap.
Not sure which service fits?
Let’s find out together.
In a free 30-minute call we look at where you stand and what would help you most. If it is not us, we will tell you who.