Application and infrastructure penetration testing

The price depends on the number of hours the test takes. A smaller test, usually without application access (black box), takes 40–60 hours. A medium test with test accounts (grey box) takes 60–100 hours. An extensive test with source code and documentation (white box) takes over 100 hours. The hours cover the whole process, including the report. We send an exact price in our quote after the initial consultation. We are a nonprofit association and not VAT-registered, so the price in our quote is final.

A test of around 60 hours takes about 4–6 weeks from signing to report delivery. Most of our clients test with us every year, so we take on only a few new clients annually. Plan your test 2–3 months ahead.

We recommend grey box. With test accounts and basic documentation, we spend the time finding vulnerabilities rather than working out how the application works. Black box simulates an attacker who knows nothing about the system. White box, with source code and documentation, goes deepest. We work with all three.

A penetration test checks how an attacker could exploit weaknesses in a specific application or network. An audit reviews system configuration and processes, such as access management, asset inventory or development security. If you have nothing specific to test yet, an audit is often the better first step.

We follow OWASP WSTG and ASVS, PTES and MITRE ATT&CK. About half the work is manual testing. Automated tools do not find flaws in permissions or business logic.

We primarily test staging or UAT environments. Production only by agreement and under rules set in advance.

Tests are carried out mainly by the five people at the core of our team, whom you can meet on our About page.

English by default, because most of our clients want it that way. On request, we prepare the report in Czech or Slovak.

Yes. Clients have used our reports as evidence for SOC 2 audits, and the auditors accepted them. If you need the test for an audit, tell us up front so we can agree on a scope that fits its requirements.

Access to other users’ data by changing an identifier in a request (IDOR), XSS, misconfigurations, leaked API keys and forgotten files on servers, such as backups or configuration files.

A description of the system, a list of the parts to test and the owner’s permission. We sign an NDA and a framework agreement and agree the environment, test accounts, a contact person and rules of engagement.

We delete raw test data when the engagement ends. We keep the report so we can build on it in a retest or the next test.

A test describes findings within a particular scope and time. It cannot guarantee there are no other vulnerabilities. Its value is concrete information for fixes, which is why most of our clients test every year.

TunaSec is an association that has been operating since 2020. Income from testing funds our TunaGuard and WebScan projects, conference participation, and hardware and software for research. As an association, we are not VAT-registered.

We do not run round-the-clock monitoring (a 24/7 SOC) and do not respond to incidents in progress. If you have just been attacked, we will recommend who to contact.