Penetration testing
We attack your systems the way a real attacker would, then show you exactly where to close the gaps.
What is penetration testing?
A penetration test is an authorised, simulated attack. We look for weaknesses, then try to exploit them safely to prove what an attacker could really reach.
That is the difference from a scan. You learn which issues matter, why they matter, and what to fix first.
Vulnerability assessment or penetration test?
A vulnerability assessment finds and lists known weaknesses, mostly with automated tools. A penetration test goes further: a tester chains weaknesses together and proves the impact by hand. Many clients ask for both, often called VAPT. We will tell you which one your situation needs.
What we test
-
Web applications and APIs
Authentication, sessions, access control, injection and business logic, tested against the OWASP Top 10 and OWASP ASVS. REST and GraphQL APIs included.
-
Mobile apps
iOS and Android apps and the APIs behind them, tested against OWASP MASVS: local storage, network traffic, authentication and reverse engineering.
-
Cloud
A security assessment of your cloud setup: identities and roles, exposed storage, network rules and logging.
-
External network
Your internet facing hosts and services, tested the way an outside attacker sees them.
-
Internal network
What an attacker can do once inside: from one compromised laptop or rogue device to your domain controllers.
-
IoT
Connected devices, their firmware, and the apps and cloud services they talk to.
-
OT and ICS
Industrial control environments, tested with care inside agreed safety limits, because availability comes first.
-
DDoS
Controlled load and resilience tests in an agreed window, to see how your services and protections hold up.
-
Phishing and social engineering
Phishing simulations and social engineering assessments that show how your people respond, and what an attacker would gain.
How we test. We follow recognised methods: the OWASP testing guides, PTES and NIST SP 800-115. Each finding gets a CVSS score, then we rank it by what it means for your business.
What you get
- A short summary for management, in plain language
- Every finding ranked by real business risk, with its CVSS score
- Evidence and steps to reproduce, so your team can confirm it
- Fixes your engineers can follow without a translator
- One retest of the reported findings, included in the price
Why Mica Shield
Built by working testers
The people who scope your test are the people who run it. OSCP, OSWA, eWPT, eCPPT and CEH Master on the team.
Licensed in Oman
Security assessment licence L3230263 and CR 1591995.
Reports that get used
Ranked by business risk, written so your engineers can act on them the same day.
How an engagement works
-
Scope
We agree what to test, when, and what is off limits. You get a scope, a timeline and a fixed price before any work starts.
-
Test
We attack your systems the way a real attacker would, inside the rules we agreed. If we find something critical, we tell you then, not at the end.
-
Report
Every finding is ranked by real business risk, with evidence and a fix your engineers can follow without a translator.
-
Fix
Your team fixes the issues. We stay available to answer questions while you work through them.
-
Retest
We test the fixes and confirm what is closed. One retest is included in the price.
Questions buyers ask
How long does a penetration test take?
It depends on scope. One web application is a smaller job than a full internal network. After a short scoping call we send a timeline with the quote, so you know the dates before anything starts.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment lists known weaknesses, mostly found by automated tools. A penetration test proves which of them an attacker can actually exploit, and how far they get. VAPT combines both.
Will testing break our production systems?
We plan to avoid it. Before testing we agree the scope, the testing windows, the contacts and any techniques that are off limits. Risky tests such as DDoS only run with your written approval, in an agreed window. If you prefer, we can test a staging copy.
What is in the report?
A summary for management, then each finding with its business risk, CVSS score, evidence, steps to reproduce and a clear fix. It is written for the engineers who will do the work.
Do you retest after we fix the issues?
Yes. One retest of the reported findings is included in the price. We confirm what is closed and flag anything that is still open.
Do you work outside Oman?
Yes. We are based in Muscat and work with clients anywhere, including Saudi Arabia, the UAE and the rest of the GCC. Most web, mobile, cloud and external testing can be done remotely.
Related services
Tell us what you need tested
We will come back with a scope, a timeline and a fixed price.