01
Plan
We agree on scope, timing, and rules of engagement, with written authorization before testing begins.
Offensive testing
Find out how an attacker would get in, before one does.
HARDAC simulates real-world attacks under agreed rules of engagement, then tells you what we found, why it matters, and how to fix it.
01 — Process
Five stages, from authorization to retest.
No testing begins without written authorization and agreed rules of engagement.
02
Discover
We map the attack surface and identify potential vulnerabilities.
03
Exploit
We safely attempt to exploit findings to confirm real risk and measure impact.
04
Report
We deliver findings ranked by severity, with evidence and specific remediation steps.
05
Retest
After you remediate, we retest to confirm each finding is closed.
02 — Test types
Types of testing.
We scope each test to the systems that matter most to your contracts and your risk.
External network
Testing of internet-facing systems, such as firewalls, VPNs, email, and public servers, from an outside attacker's point of view.
Internal network
Testing from inside your network to show what an attacker or compromised device could reach, including lateral movement and privilege escalation.
Web application
Testing of your applications and APIs for weaknesses such as broken authentication, injection, and access control flaws.
03 — Compliance
Testing that supports compliance.
Penetration testing gives you evidence that your controls work. We scope each test so the results serve both your security and your compliance program.
- Supports the risk and security assessment requirements in NIST SP 800-171 and CMMC Level 2
- Corresponds to control CA-8 in NIST SP 800-53 for systems under the Risk Management Framework
- Required at CMMC Level 3 under NIST SP 800-172
04 — What you receive
A report for leadership and for engineers.
One report, written for both audiences, followed by a retest after remediation.
Executive summary
A plain-language overview of overall risk and the most important findings, written for leadership.
Technical findings
Each vulnerability with its severity, affected systems, evidence, and step-by-step remediation guidance.
Retest results
Confirmation of which findings are closed after you remediate.
Get started
Scope a penetration test.
Tell us which systems you want tested and any compliance requirements the results need to support.