Penetration Testing & VAPT

A penetration test shows where an attacker could get in, before one does. Iteb Co delivers vulnerability assessments and penetration testing (VAPT) for organisations in South Africa and Zimbabwe. Findings are scored using CVSS and reported in clear, practical terms.

Request a Quote Free Assessment

Vulnerabilities are found in networks, applications and cloud environments every day. A penetration test simulates a real attack, to show which of them can truly be exploited.

Evidence of regular security testing is increasingly expected under POPIA, the FSCA Joint Standard and the Cyber and Data Protection Act of Zimbabwe. A scheduled test costs far less than an incident.

• External and internal networks
• Web applications and APIs
• Cloud infrastructure
• Wireless networks
• Social engineering, on request

Testing is mapped to recognised frameworks, including the OWASP Top 10 and CVSS scoring. Each engagement ends with a report covering severity ratings, proof of exploitation where relevant, and remediation guidance for technical and non-technical readers.

Risk can also be monitored between formal tests. An ongoing view of the organisation is provided, which includes:

• A continuously updated cyber risk score
• Automated vulnerability scanning on a recurring schedule
• Dark web and breach exposure monitoring for domains and credentials
• Compliance mapping against POPIA and the Cyber and Data Protection Act
• Masking of personal data during automated scans
• Reporting suitable for cyber insurance discussions

1. A scoping call is held to confirm the environment, objectives and constraints.
2. A testing window is agreed and communicated in advance.
3. Testing is carried out using automated tools and manual techniques.
4. Findings are validated, so that false positives are removed.
5. A report is delivered with severity ratings and remediation steps.
6. A retest can be carried out once fixes have been applied.

A vulnerability assessment and retest were delivered for a government institution in Zimbabwe, following a cybersecurity consultation. External vulnerability assessments are now carried out for that institution on an ongoing basis. More detail for Zimbabwean organisations is given on our VAPT for corporates and government in Zimbabwe page.

• Recognised methods. Testing is aligned with the OWASP Top 10 and CVSS.
• Clear reporting. Reports are written for both technical teams and management.
• Retesting available. Fixes are verified, not assumed.
• Local compliance knowledge. South African and Zimbabwean requirements are both covered.