Penetration testing
Estimate cybersecurity capacity
Vulnerability assessment on the internal and external IT perimeter
Employee cybersecurity awareness testing
Simulation of targeted attacks
Unearthing real problems
infrastructures with a high level of security, according to the statistics of our audits in 2019
of companies leak information about the system and its users
of cases resulted in access to personal data of clients or employees
employees at Russian companies are vulnerable to phishing
Evaluating all elements of the infrastructure
We help to stay ahead of cybercriminals
We use international standards and our own methodologies for a more in-depth search for vulnerabilities.
We rank the vulnerabilities by a degree of criticality and indicate which ones are most likely to attract attackers.
We give clear recommendations on how to fix vulnerabilities, and not just list the problems found.
We help at all stages of eliminating vulnerabilities and for reliability we check that all the gaps are closed.
Solution with maximum benefits
- if the infrastructure was changed
- if the office is expanding to a new location
- if regulatory requirements need to be met
- are employees prepared for cyberattacks?
- is there a need for modernisation or new tools?
- is the threat model up-to-date?
- before connecting to a new infrastructure
- before insuring cyber-risks
- before making an investment
Problems that we solve
Discover critical vulnerabilities fast
Automated scanning reveals the most serious vulnerabilities of the external and internal IT perimeters.
We scan the infrastructure with special software followed by manual verification of the results: discard false positives and evaluate the criticality of the vulnerabilities found. The final report will contain only real flaws with clear recommendations for elimination.
Check the company’s resilience to intrusions from the Internet
External penetration testing provides an expert assessment of the security of the external IT perimeter.
We simulate the actions of a potential attacker and evaluate how much damage they could inflict on the company. The service includes both automated scanning and expert checks: they reveal 75% more vulnerabilities, and often the most critical ones.
Assess the effectiveness of internal security mechanisms
Internal penetration testing simulates an attack on behalf of an internal attacker.
We analyse what opportunities a person has with the rights of a user or administrator in a corporate network, and recommend protective measures against an insider: the correct separation of access rights, the safest configuration of services and so on.
Check incident response
Simulation of targeted attacks allows companies to evaluate the effectiveness of a full-time cybersecurity team and the established protective solutions.
Based on the experience of dealing with real cybercriminals, we imitate the actions of an attacker who specifically targets the company. No more than a couple of people on the client’s side are aware of the simulation, so the assessment is as objective as possible.
.svg)
Teach employees how to counter social engineering attacks
Employee awareness testing determines whether it is easy to compromise company resources through phishing and other human factor attacks.
The service helps identify and train employees who believe in phishing emails, open “forgotten” flash drives and provide important information in a telephone conversation with a supposed “Jeff from accounting”.
BI.ZONE Penetration Testing Unit is accredited by CREST — the international cybersecurity association.
BI.ZONE expert services are in full compliance with ISO 9001 and ISO 27001.
Professional team
Our competence is confirmed by a number of internationally recognised certificates from the world’s largest agencies and institutions, including Offensive Security, EC-Council, (ISC)2, SANS, Cisco.
We carry out more than 70 projects a year for the largest banks, IT and telecom companies, customers from the e-commerce, big industry and the media.
Our employees teach security analysis at MEPhI, HSE, as well as courses at Russian and European educational centres and corporate universities.
Our specialists are frequent guest speakers at conferences and work on discovering new vulnerabilities in the products published by large vendors.