Skip to content
Request assessment

SIEGE · Infrastructure Pentest

How long would it take an attacker to take over your company?

We simulate a real attack on your perimeter, network and accounts. We show you the path and how to close it.

Request assessmentView packages

The risk

SMEs are the easiest target

  • 01

    Ransomware

    A single compromised machine can encrypt the whole network in hours.

  • 02

    Leaked credentials

    Employee passwords already circulating in public leaks.

  • 03

    Weak Active Directory

    Inherited permissions and service accounts that give full control.

  • 04

    Phishing

    The inbox is still the most used way in.

Packages

Choose your scope

Each package includes everything in the previous one.

Indicative prices excluding VAT. Final price is confirmed after the scoping call.

  • Entry point

    OUTPOST

    Price: From €2,500

    excl. VAT

    Approach
    White-box: you share IPs and configuration

    What's included

    • Exposed IPs, ports and services (VPN, RDP, mail, web).
    • Email: SPF, DKIM and DMARC.
    • OSINT and employee credentials in public leaks.
    • Report with evidence and priorities.

    Not included: internal network, Active Directory or phishing.

    Request assessment
  • Recommended for most SMEs

    INFILTRATE

    Price: From €6,500

    excl. VAT

    Approach
    Grey-box: internal machine with a standard user

    What's included

    • Everything in OUTPOST.
    • Internal network: segmentation and insecure protocols.
    • Active Directory: privileges, Kerberos and paths to admin.
    • Controlled lateral movement, no persistence.
    • Microsoft 365 or Google Workspace review.
    • Technical and executive report, plus a results session.

    Not included: Wi-Fi, phishing or IaaS cloud.

    Request assessment

  • TAKEDOWN

    Price: From €11,000

    excl. VAT

    Approach
    Black-box: from scratch, like a real attacker

    What's included

    • Everything in INFILTRATE.
    • Corporate and guest Wi-Fi, on site.
    • Simulated phishing campaign.
    • Cloud: Azure or AWS (identities and exposure).
    • Fix re-test included.
    • Results presentation to management.

    Not included: OT environments or physical access testing.

    Request assessment

  • Custom

    Price: Price On request

    excl. VAT

    Approach
    Custom

    What's included

    • More sites, devices or cloud environments.
    • OT / industrial environments.
    • Recurring pentest (quarterly or half-yearly).
    • Evidence for NIS2, ISO 27001 and audits.
    Request assessment

Methodology

PTES in 7 phases

  1. 01

    Pre-engagement

    Scope and rules of engagement in writing.

  2. 02

    Intelligence gathering

    Technologies, domains and in-scope assets.

  3. 03

    Threat modelling

    Which assets matter and who would attack them.

  4. 04

    Analysis

    Flaws found and ranked by risk.

  5. 05

    Exploitation

    Controlled proof that the flaw is real.

  6. 06

    Post-exploitation

    Impact proven, no persistence or real data.

  7. 07

    Reporting

    Executive summary, technical detail and fix plan.

After the report

Fix re-test

Included in OPERATION and TAKEDOWN. In Custom, depending on scope.

Sample report

What a DELSTRIKE report looks like

A real report from our lab: methodology, CVSS-scored findings, reproducible evidence and a remediation plan. The same format you'd get for your project.

  • Executive summary for management
  • Findings scored with CVSS v3.1
  • Evidence and reproduction steps
  • Prioritised remediation plan
Download PDF

20 pages · PDF — Report from a lab environment, for demonstration. It contains no client data.

Compliance

Evidence for your audits

  • GDPR

    Supports security of processing (Art. 32). Data minimised and never extracted.

  • NIS2

    Regular, documented testing as part of risk management.

  • PCI-DSS

    Pentest evidence for Requirement 11.

  • ISO 27001

    Findings mapped to Annex A controls.

Always with written authorisation. The report doesn't guarantee compliance on its own.

FAQ

Frequently asked questions

Will you disrupt my business?

No. We never use denial of service and we agree on test windows. If anything puts operations at risk, we stop and let you know.

What do you need from us?

A technical contact and the signed authorisation. For INFILTRATE, also a machine or VPN with a standard user. For TAKEDOWN we start from scratch, with no prior information.

Do you need to come to the office?

Only for TAKEDOWN, for the Wi-Fi tests. Everything else is remote.

Does phishing single out employees?

No. Results are delivered in aggregate to improve training, not to blame anyone.

Is it valid for NIS2 or ISO 27001?

Yes, as evidence of regular technical testing. It doesn't guarantee compliance on its own.

What if you find something critical?

We stop, notify your contact the same day with evidence and a temporary mitigation, and agree how to proceed.

Contact

Let's talk

Leave your company and email and we'll get in touch.

We'll only use your data to answer your request. More information in our privacy policy.