Remote penetration testing, worldwide

Frameworks we map to

ISO/IEC 27001 and SOC 2

Most remote clients are SaaS companies and enterprises pursuing ISO/IEC 27001 certification or a SOC 2 report. Reports carry the control references and the retest evidence auditors ask for, so a single engagement covers the penetration-testing line in your audit.

PCI DSS

Requirement 11 testing and segmentation validation for card processors and merchants, with the retest evidence your QSA needs.

EU clients: DORA, NIS2 and GDPR

For clients in the Netherlands, Germany and elsewhere in the EU, findings can be mapped to DORA for financial entities and to NIS2 for essential and important entities. Findings that expose personal data are flagged under GDPR, and we sign a data-processing agreement with standard contractual clauses where personal data may be encountered. UK clients have their own page: penetration testing in the UK.

Other frameworks

Name yours and we map findings to it, whether that is the NIST Cybersecurity Framework, a customer's security schedule or a national standard.

What is usually in scope

Remote scopes cover anything reachable over the internet or through the drop-box: web applications and their APIs, mobile applications, cloud workloads and their configuration, the external perimeter including VPN and email, and the identity provider. Through the drop-box we add Active Directory, segmentation, wireless and the remote access paths used by vendors. SaaS clients often include a source-assisted review of the authorisation layer, which finds more in the same time than black-box testing alone, and teams shipping LLM features add AI security testing.

How the drop-box works

For internal work we ship a small hardened appliance. Your team plugs it into the network segment we agree; it connects back to us over an encrypted tunnel that only our testers can reach, and it is wiped when the engagement ends. Shipping takes about two days within the GCC and up to a week elsewhere. If customs or policy rule out hardware, we can run the same test from a virtual machine you host, or send testers on-site for a few days.

Communication and evidence handling

Remote engagements live or die on communication. Scoping runs online in your working hours, with rules of engagement, excluded systems and change windows confirmed in writing. Daily syncs run on your channel of choice, and confirmed criticals are reported the same day rather than at the end. Evidence is encrypted, stored in a region you choose and deleted 90 days after the report unless you ask otherwise. The report is walked through with engineers and with whoever owns risk, and the free retest within 90 days means audit evidence closes in one engagement.

Time-zone coverage

We are on Gulf Standard Time, UTC+4, and regularly work with teams from UTC-8 to UTC+9. For the Americas our testers run late sessions; for Asia-Pacific our morning overlaps with your afternoon; for Europe and Africa we share most of the working day.

Recent engagements

SaaS platform, North America

An authorisation bypass in a multi-tenant API and an SSRF in a webhook handler. Both fixed and retested within the client's sprint.

E-commerce group, South-East Asia

Payment-flow tampering and account takeover through the password-reset flow. Closed before the peak trading season.

Enterprise, Africa, internal network via drop-box

An Active Directory attack path to domain admin within four hours of the drop-box coming online. A remediation plan was delivered with the infrastructure team.

All engagements are anonymised and described with client approval.

Why Vulnera here

You get senior testers from a firm that also builds and runs its own platform, with a public disclosure policy and a Labs environment your engineers can practise in. Every finding comes with the request, the response and the fix. See penetration testing for the full service, red teaming for objective-based work, or custom SaaS if you want help building the fix.