Close what an attacker could actually reach.

ArcTech repairs security weaknesses across Azure, Entra ID, Active Directory, APIs, web applications and networks. The work is done by someone who breaks into these systems professionally, which is what makes a fix verifiable rather than assumed: whoever closes a finding can prove the attack path it belonged to no longer completes. Start with a short review of where the exposure sits, commission a test that proves what can be reached, or bring in engineering to close findings you already have.

Book a scoping call

30 minutes · no cost · you leave with a scope, an estimate and a date

Services

01 · REVIEW

Threat Actor Perspective

A short, structured look at the environment the way an attacker would approach it. One or two working sessions with your architects, read-only access, and a focused review of where an intruder would go first. Nothing is attacked and nothing is disrupted. The result is a ranked set of attack paths, the reasoning behind each one, and a clear recommendation on what to fix, what to test, and what can wait.

AzureEntra IDActive DirectoryIdentity modelTrust boundariesAttack pathsThreat modelingNetwork segmentationAPIs & webOn-prem & hybrid

€1 600–5 000 1–3 days · no testing Read more →

02 · TESTING

Manual Penetration Testing

A great deal of what is sold as penetration testing is a scanner run with a report template on top, or a model instructed to attack something and whatever it returned passed along. Tooling has its place and ArcTech uses it to cover ground faster, never as the deliverable: every finding is reproduced and validated by hand, by someone who understands how the exploitation path was built, before it reaches your report. A fully manual engagement is available on request, with nothing about your environment processed by a model and nothing leaving ArcTech's network. The methodology is published below, and you are not billed for false positives.

Fully manual optionOWASP WSTGOWASP Top 10OWASP API Top 10PTESNIST SP 800-115Azure & Entra IDActive DirectoryAssumed breachWeb applicationsREST & GraphQL APIsOAuth2 / OIDCExternal network

€8 500–26 000 1–3 weeks · scope-dependent Read more →

03 · REMEDIATION

Vulnerability Remediation

Findings are easy to produce and expensive to leave open. Once the environment is understood, from a Threat Actor Perspective review, a penetration test, or a report someone else wrote, ArcTech implements the fixes and verifies they hold across cloud, identity, APIs, web, application code and network. Where a finding cannot be fixed, because a library has no patched release or a rebuild costs more than the risk warrants, the attacker's use of it is removed instead and the residual risk is written down. Work is prioritized by attack chain rather than severity label: low and medium findings that combine into a route to domain or tenant compromise are treated as more urgent than an isolated high that leads nowhere.

Azure & cloudEntra ID & identityActive DirectoryConditional Access & PIMAPIsWeb applicationsApplication codeNetwork & segmentationIaC, Bicep / TerraformCI/CD pipelinesSecrets & key managementPowerShell & C# tooling

Request a quote Typically 2–3 months · scope-dependent Read more →

Book a scoping call

30 minutes · no cost · you leave with a scope, an estimate and a date

contact@valtberg.com