VAPT · Offensive security
Vulnerability assessment & penetration testing.
Proof, not a checklist.
Manual testing by certified operators (OSCP, OSCE, GPEN). Every finding is validated, scored and mapped to ISO 27001, NIST CSF and BSSN — then retested free of charge.
0
False positives reported
40+
Tools in the arsenal
100%
Findings manually validated
The problem
Scan-and-report testing produces findings nobody can act on: false positives, generic checklists, and CSV exports that die in a backlog.
Track record
Delivered for social security institutions, national transport operators, pharmaceutical companies, and fintechs across Indonesia and Southeast Asia.
Our approach
- Hybrid model: automated discovery across 40+ industry tools plus Zentara-engineered utilities, backed by manual exploitation from certified operators (OSCP, OSCE, GPEN, GXPN, CEH).
- Zero false-positive policy — every finding is validated and reproducible before it reaches your report.
- Coverage across network, web, mobile, API, cloud, wireless/IoT, and social engineering.
- Dual-layer reporting: an executive summary with business risk and resilience score, and a technical report with CVSS v3.1 scores, exploit PoCs, and a patch roadmap.
- Patch validation retest included at no extra cost.
What we test
Every surface an attacker can reach
One discipline, applied across the whole estate. Need a specific test named? The full catalog lives on the Offensive Security hub.
Network & Infrastructure
External, internal, Active Directory, wireless, segmentation, VPN, and config review.
Application
Web, API (REST/GraphQL/gRPC), mobile, thick-client, and secure code review.
Cloud
AWS/Azure/GCP configuration, cloud pentest, containers, and Kubernetes.
Wireless & IoT
Wi-Fi attack stack, BLE, firmware, and connected-device backends.
Human layer
Phishing and social engineering, physical intrusion, assumed-breach.
Specialized
OT/ICS, blockchain and smart contracts, AI/ML and LLM application security.
Black, grey, or white box
How much do we know before we start?
“Box” just describes how much you tell us up front. It's a choice inside the pentest — not three different services.
Black box
Zero knowledgeWe start exactly where an external attacker starts — no credentials, no diagrams, no inside help. The truest test of your perimeter.
Grey box
Assumed breachWe begin with partial knowledge or a low-privilege account — the realistic scenario where an attacker already has a foothold. Best value per day.
White box
Full knowledgeFull access to source, architecture, and credentials — maximum coverage and depth in the time available. The most thorough option.
Want the full ladder — from assessment through red team and purple team to continuous validation? That’s the Offensive Security depth model.
Methodology
Six stages, one authorized engagement
Every engagement runs the same disciplined lifecycle — scoped and fixed in the Rules of Engagement before a single packet is sent.
Define & Authorize
Formal Rules of Engagement: written authorization, NDA, scope, exclusions, escalation contacts.
Discover & Enumerate
OSINT, network mapping, service enumeration — 3–5 business days.
Analyze & Correlate
Automated + manual scanning with analyst validation.
Exploit & Validate
Manual exploitation, privilege escalation, lateral movement — 8–12 business days.
Document & Report
CVSS-scored dual-layer reporting — 3–5 business days.
Remediate & Retest
Verification of closure — 5–10 business days, included.
What you receive
Two reports. Every audience covered.
Findings nobody can act on are worthless. Every engagement ships a board-ready narrative and an engineer-ready fix list — from the same evidence.
For the board and the CISO
Executive report
- Business-risk narrative, not raw findings
- Resilience score you can trend over time
- Risk heatmap by severity and business impact
- Compliance mapping — ISO 27001, NIST CSF, BSSN, PCI DSS
For the engineers who fix it
Technical report
- Every finding with a reproducible exploit proof-of-concept
- CVSS v3.1 scoring on each vulnerability
- Prioritized, step-by-step patch roadmap
- Traceable evidence back to the tested asset
Free retest included. Once you’ve remediated, we verify closure on every finding and reissue the report — proof for auditors and the board that the issues are actually fixed.
How you buy it
Three commercial models
The same testing discipline, priced the way your program actually runs.
Fixed-scope engagement
One target, one statement of work, one report — the classic pentest for annual compliance and point-in-time assurance.
Bulk mandays
A pool of expert days at a locked rate, drawn down across the year against any target — a new release, an acquisition, a regulator request. Removes procurement friction on every test.
Continuous validation
CTEM and Breach & Attack Simulation — stop testing once a year and validate every TTP, every quarter, with detection engineering built in.
Delivered by certified operators
Deepest vertical
Banking & FSI has its own catalog
Core banking, payment switches, SWIFT CSP, Indonesia’s payment rails (QRIS, BI-FAST, SNAP), cards & PCI, and channel security — 83 regulator-mapped tests built for financial institutions.
FAQ
Common questions
Straight answers. If yours isn't here, ask us directly.
A vulnerability assessment identifies and prioritizes known weaknesses. A penetration test exploits them the way a real attacker would — proving impact, not just existence. Zentara engagements combine both.
Typical lifecycle: 3–5 business days planning and reconnaissance, 8–12 days testing, 3–5 days reporting, and 5–10 days for remediation retest. Scope determines the final schedule, fixed at RoE.
Black box tests your perimeter the way a real external attacker sees it, with zero prior knowledge. Grey box starts from an assumed breach — a low-privilege account or partial knowledge — and gives the best coverage per day. White box gives us full source and architecture access for maximum depth. It's a choice inside the pentest, and we'll recommend the right one for your objective at scoping.
Yes — patch-validation retest is included at no extra cost. After you remediate, we verify closure on every finding and update the report, so you have proof for auditors and the board that the issues are actually fixed.
Every finding is manually validated and reproduced by a certified operator before it reaches your report. Automated tooling discovers; humans confirm. You never receive a scanner dump — only findings we have proven exploitable.
Yes. Engagements map to the standards you answer to — OJK POJK 11, BSSN, PCI DSS v4.0.1 Req 11.4, SWIFT CSCF, and ISO 27001 — with compliance traceability in the report. Banking & FSI has its own deep catalog of regulator-specific tests.
Scope a VAPT engagement
Tell us what you're protecting and how far you want us to push. We'll respond with surface, depth, method, and timeline — no generic pitch decks.