Penetration testing for networks, web applications and Microsoft 365.
A penetration test (pentest or pen test) is an authorized, simulated attack on your systems to find the weaknesses a real attacker could use. Our penetration testing services for Toronto and GTA organizations cover your perimeter, internal network, web applications and cloud tenant; every finding is verified by hand, rated by real-world impact and paired with a fix your team can carry out.
Fictional matter. Same structure as the reports we deliver.
$2M cyber liability insurance · Since 2018 · We work under counsel’s direction when counsel is retained
Reviewed by the ITRS security team · Last updated
If a finding ends up in a dispute, we also act as a digital forensics expert witness.
When you need a penetration test.
- An insurer, client or tender requires an independent test
- You have launched a new application, portal or office
- A change of IT provider or a merger has left you unsure what is exposed
- You want evidence that last year’s fixes worked
External network penetration testing
Internet-facing hosts, VPNs, remote access and email infrastructure tested for exploitable weakness.
Internal network penetration testing
An assumed-breach view: what an attacker on one laptop could reach, escalate and take.
Web application penetration testing
Authentication, session handling, access control, injection and business-logic testing against OWASP guidance.
Microsoft 365 and cloud penetration testing
Identity, conditional access, sharing and administrative exposure in your tenant.
What our penetration testing report includes.
- 01Executive summary for leadership
- 02Technical findings with evidence and CVSS ratings
- 03Prioritized remediation plan
- 04Retest of fixed findings and confirmation letter
Fictional engagement. Preview of the first 3 of 11 pages.
Before you call.
- How much does a pentest cost?
- It is priced from the scope, not from a list: the number of internet-facing hosts, the size of the internal network, how many web applications are in scope and how many cloud tenants are tested. Retesting of fixed findings is included. Send us the scope and we reply with a written quote.
- Is pentesting illegal?
- Not when it is authorized. Section 342.1 of the Criminal Code makes it an offence, punishable by up to 10 years, to obtain computer service or use a computer system fraudulently and without colour of right. That is why every IT Rapid Support penetration test starts with written authorization from the system owner setting scope, testing windows and contacts.
- How is pentesting done?
- In five steps: (1) scope and written authorization; (2) testing of external hosts, the internal network, web applications and Microsoft 365, as agreed; (3) every finding verified by hand and rated with CVSS; (4) a report with an executive summary, technical evidence and a prioritized fix plan; (5) a retest of fixed findings and a confirmation letter.
- Is a retest included?
- Yes. Once your team has fixed the findings, we retest them and confirm the result in writing, so you can show a client, insurer or auditor that the issues were closed rather than just reported. Findings that are not fixed stay on the record with their rating.
- Will testing disrupt the business?
- It should not. Testing windows, exclusions and contacts are agreed in writing before anything starts, and anything that could affect production, such as load on a fragile server, is scheduled with you. If we find something critical mid-test, we call you rather than wait for the report.
Related services.
Incident Response
A 24/7 line to responders who contain first, preserve evidence second and explain everything.
Digital Forensics
Forensic acquisition and analysis of laptops, phones, mailboxes and cloud tenants, with chain of custody.
Attestation & Assessments
Independent security assessments, Microsoft 365 audits and attestation letters for clients, insurers and auditors.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.