What would an attacker looking at us today actually see ?
Under written mandate, the cabinet carries out the reconnaissance an attacker would run before acting: what answers, what is reachable, what has been left lying around, what could be taken over. It is the last step before a penetration test, and it often explains an incident on its own.
- Price2 400 € excluding VAT, fixed price
- Lead time5 working days
- Who it is forunder written mandate, never without one
0writes
Nothing exploited, nothing forcedReconnaissance observes and maps. It exploits no weakness, forces no access and never writes on your servers. The written mandate sets its perimeter and its boundaries.
You want to know what your infrastructure shows to somebody who is not a client. Under a written mandate that fixes the perimeter, the addresses, the boundaries and the intervention window, the cabinet runs the same reconnaissance an attacker would run before acting: the open ports and the reachable services with their versions when they announce them, the sensitive paths left accessible such as backups, logs and configuration files, the injection surface of your forms and exposed parameters, the forgotten subdomains and those that could be taken over. Nothing is exploited, nothing is forced, and nothing is ever written on your servers. After five working days you receive a report ranked by severity, with what to close first and how to verify it, for 2 400 € excluding VAT. Without a signed mandate, nothing starts, not even for a client already under contract.
The map of what you offer to view.
- The open ports and the services reachable from outside, with their versions when they announce them.
- The sensitive paths left accessible: backups, logs, configuration files, administration interfaces.
- The injection surface of your forms and of your exposed parameters.
- The forgotten subdomains, and those that could be taken over.
- A report ranked by severity, with what to close first and how to verify that it is closed.
Written mandate
Perimeter, addresses, boundaries and intervention window, signed. Without a mandate, nothing starts.
Reconnaissance
Passive then active mapping, inside the perimeter and nowhere beyond it.
Report
Findings ranked, each with its evidence, its severity and its remediation.
The limits, in writing.
An engagement that does not state its limits lets the client discover them at the worst possible moment.
- This is not a penetration test: no weakness is exploited and no access is taken. It is the step before one.
- This is not a code audit: the hosted code is not read, only the exposed surface is observed.
- It is never carried out without a written mandate, not even for a client under contract. The cabinet refuses verbal consent.
Knowing what you expose costs less than an incident.
Reconnaissance is included in the full audit. The critical items are then closed by the remediation plan, or inside the hours allowance of a governance contract.
A first conversation of 30 minutes
No obligation, no access to your systems. We look at whether the step you are considering is the right tool for your situation, and the cabinet says no when it is not.
A signed scoping letter
The perimeter, the read-only access, the people, the delivery date and the firm price. Nothing starts before your signature.
The report, then the decision
A dated report that holds up in front of a third party, a session with your executive team, and the list of gaps ranked. You then decide what follows, or you stop there.
5 questions, 5 answers.
The cabinet's answers, in plain terms. If your question is not here, ask it: the answer comes back to you in writing.
How much does offensive reconnaissance cost, and how long does it take?
2 400 € excluding VAT, fixed price, over 5 working days once the mandate is signed. It is included at no extra cost in the full audit at 8 900 € excluding VAT.
Is this a penetration test?
No. No weakness is exploited and no access is taken: reconnaissance observes and maps what your infrastructure exposes. It is the step that precedes a penetration test, and in practice it often explains an incident without one.
Why do you insist on a written mandate?
Because active scanning of an information system without authorisation is unlawful, and because a verbal agreement protects nobody. The mandate names the perimeter, the addresses, the boundaries and the intervention window. The cabinet sells compliance; it does not work around it.
Could this break something on our infrastructure?
The method is non-destructive and nothing is ever written on your servers. The mandate sets the intervention window precisely so that the active phase happens when you choose, and the cabinet stops at the first sign that a service is degraded.
What happens if you find something critical during the survey?
You are told immediately, in writing, before the report is finished, with what to close first. If the finding points to an actual compromise, the cabinet documents the timeline and the affected perimeter for your notification obligations under article 33 of the GDPR, and proposes a scoped incident response. Nothing is engaged without your written agreement.