Blackbox
No information
The auditor has no prior information about the target. They operate as an external attacker with no knowledge of the infrastructure.
Information level
How far could an attacker
get into your systems?
Our offensive security experts reproduce realistic attack scenarios to identify the exploitable vulnerabilities in your systems, applications and infrastructure. You get a concrete view of your exposure and of the actions to prioritise to strengthen your security.
10+ years
Of pentest expertise
1,000+
Engagements completed
200+
Critical vulnerabilities identified in 2025
120
Vulnerabilities patched in 2025
Why test
A test today can prevent a crisis tomorrow.
No one is spared by cyberattacks. In a controlled setting, our experts use the same techniques and tools as real attackers to identify exactly where and how an attacker could act, so that you can fix it before it is too late.
- Vulnerabilities published in August 2026, twice as many as in January: AI is speeding up their discovery
- 10,740
Google Threat Intelligence, September 2026 (new tab)- Ransomware attacks launched through an exposed device, most often a VPN or a firewall
- 1 in 3
- International observation cited by the FOCS, 2026/1 (new tab)
Our services
Our types of tests
Each engagement is tailored to your context, your infrastructure and your security objectives. We cover a wide range of offensive scenarios.
External pentest
We test your attack surface exposed on the internet (servers, web applications, APIs and more) exactly as a remote attacker targeting your organisation would.
Internal pentest
Simulation of an attacker with access to the company's internal network. We identify the paths to compromise your most critical assets (Active Directory, file servers, databases and more).
Social engineering
Are your employees your weakest link? Phishing, vishing and manipulation tests to assess human vigilance against today's attack techniques.
Mobile application
Security analysis of iOS and Android applications and their back ends. We assess local storage, network communications, authentication and application logic.
IoT & connected devices
Security assessment of your connected devices and their communication protocols. Firmware, network interfaces, physical attack surface: we analyse every vector.
Wi-Fi network
Penetration testing of your wireless networks: detection of rogue access points, attempts to bypass authentication, interception of network traffic.
Web pentest
In-depth security assessment of your web applications and APIs following the OWASP Web Security Testing Guide. We test access control, sessions, inputs, business logic, cryptography, configuration and client-side interactions, among others.
AI / LLM pentest
Assessment of solutions built on language models following the Secure AI Framework (SAIF). The tests cover the data, the infrastructure, the model and the application, including prompt injection, information leakage and autonomous actions.
Going further
Simulate a full-scale attack.
Beyond the classic pentest, red teaming and purple teaming test your organisation as a whole: technical, human and organisational.
Red Team
The realistic attack, no holds barred
A multi-vector attack simulation run by our offensive operators, against a precise objective agreed with you. Phishing, physical intrusion, technical exploitation: every means is brought to bear.
- Realistic attack scenario over several weeks
- Multi-vector: technical, human, physical
- A test of your detection and response chain
- Detailed executive and technical report
Purple Team
Collaborative learning
Attack and defence work together in real time. Your SOC or IT teams watch the attack techniques and adjust their detections as they go: a maturity accelerator.
- Collaborative attack ↔ defence sessions
- Detection rules improved live
- Upskilling of your in-house teams
- Mapping of detection gaps
3 levels of penetration testing
Penetration tests can be run from 3 different attack angles, each simulating a distinct level of attacker knowledge.
Greybox
Partial information
The auditor has limited information (standard credentials, partial documentation). Simulates an attacker who has gained a first level of access.
Information level
Whitebox
Full access
The auditor has full access to the source code, the architecture and the configurations. Allows an exhaustive analysis of every security layer.
Information level
Our methodology
Six phases, from scoping the engagement to the remediation plan.
Augmented expertise
AI & our penetration tests
At SecuLabs, AI supports our experts' work without ever replacing their judgement. It enriches certain analyses, cross-checks more signals and takes the findings further, while keeping human validation and full control at every step. Our goal: ever more precise, thorough and effective penetration tests.
Certified teams.
Our experts hold the industry's most recognised certifications, a guarantee of uncompromising expertise.
- OSCE3, Offensive Security Certified Expert 3, OffSec
- OSEP, OffSec Experienced Penetration Tester, OffSec
- OSWE, OffSec Web Expert, OffSec
- OSED, OffSec Exploit Developer, OffSec
- OSCP+, Offensive Security Certified Professional+, OffSec
- OSCP, Offensive Security Certified Professional, OffSec
- CRTE, Certified Red Team Expert, Altered Security
- CRTL, Certified Red Team Lead (Red Team Ops II), Zero-Point Security
- HTB CPTS, Certified Penetration Testing Specialist, Hack The Box
- CRTO, Certified Red Team Operator, Zero-Point Security
- CRTP, Certified Red Team Professional, Altered Security
- CARTP, Certified Az Red Team Professional, Altered Security
- AzRTE, Azure Red Team Expert, HackTricks Training
- GWAPT, GIAC Web Application Penetration Tester, GIAC
- HTB CWES, Certified Web Exploitation Specialist (ex-CBBH), Hack The Box
- HTB COAE, Certified Offensive AI Expert, Hack The Box
- eCPPT, Certified Professional Penetration Tester, INE Security
- GSNA, GIAC Systems and Network Auditor, GIAC
- GMON, GIAC Continuous Monitoring, GIAC
- CCSE, Check Point Certified Security Expert, Check Point
- CCSA, Check Point Certified Security Administrator, Check Point
- CCNA, Cisco Certified Network Associate, Cisco
- NSE 4, Fortinet NSE 4, FortiOS, Fortinet
- CSNA, Certified Stormshield Network Administrator, Stormshield
- CyberArk PAM, CyberArk Defender, Privileged Access Management, CyberArk
- Proofpoint ITS, Proofpoint Certified Identity Threat Specialist, Proofpoint
- CISSP, Certified Information Systems Security Professional, ISC2
- ISSAP, Information Systems Security Architecture Professional, ISC2
- CISM, Certified Information Security Manager, ISACA
- CISA, Certified Information Systems Auditor, ISACA
- CCSP, Certified Cloud Security Professional, ISC2
- ISO 27001 LA, ISO/IEC 27001 Lead Auditor, PECB
- ISO 27001 LI, ISO/IEC 27001 Lead Implementer, PECB
- CIPP/E, Certified Information Privacy Professional/Europe, IAPP
- AWS Security, AWS Certified Security, Specialty, Amazon Web Services
- AWS Architect, AWS Certified Solutions Architect, Associate, Amazon Web Services
- CKA, Certified Kubernetes Administrator, The Linux Foundation
- PRINCE2, PRINCE2 Practitioner, PeopleCert
- HERMES, HERMES Foundation, the Swiss federal project management method, Swiss Confederation
- FCP Cloud, Fortinet Certified Professional, Cloud Security, Fortinet
- Netskope, Netskope Security Cloud Operation & Administration, Netskope
- GitLab CI/CD, GitLab Certified CI/CD Associate, GitLab
- ITIL, ITIL Foundation, PeopleCert
- Six Sigma, Six Sigma Green Belt, Six Sigma
Our vision
The vision of Patrick, Head of the Offensive Security practice.
We put your defences to the test against real attacks, to close the gaps before they are exploited.
Build the skills
Our training: build your offensive security skills
Take the lessons of a pentest further and strengthen your teams' skills with technical courses led by our experts.
Frequently asked questions.
A pentest simulates a real attack, in a controlled setting, to identify the exploitable vulnerabilities in your information system. The aim is to understand how far an attacker could go and to fix the flaws before they are used against your organisation.
SecuLabs runs external and internal pentests, social engineering tests, and tests of mobile applications, connected devices, Wi-Fi networks and web applications, as well as AI and LLM solutions. Each engagement is tailored to your infrastructure, your risks and your security objectives.
An external pentest assesses the systems and services reachable from the internet, as a remote attacker would. An internal pentest simulates an attacker who already has access to the company network, to identify the opportunities for lateral movement, privilege escalation and access to sensitive data.
An engagement starts by defining the scope and the rules of the test. Our experts then carry out the reconnaissance, mapping, vulnerability research and exploitation phases, before presenting the results in a report with a remediation plan.
A Blackbox test is carried out with very little information about the target. In Greybox, the pentester has some access or information, while a Whitebox test allows an in-depth analysis with full knowledge of the environment. The level is chosen according to your objectives and the scenario you want to reproduce.
Our web pentests assess authentication, access rights, sessions, APIs, user input, business logic, configuration and data protection, among other things. The tests draw in particular on the OWASP Web Security Testing Guide to cover the main vulnerabilities of web applications.
Yes. SecuLabs assesses solutions that integrate artificial intelligence models or LLMs by analysing the data, the infrastructure, the model and the application. The tests can cover prompt injection, information leakage, model manipulation and unwanted actions by agentic systems.
SecuLabs provides a report detailing the vulnerabilities identified, their criticality, the exploitation scenarios and the remediation recommendations. The aim is to help your teams understand the risks and prioritise remediation effectively.
Take action
Interested in this service?
Let's discuss your specific needs and build a solution suited to your context together.