Manual Penetration Testing
A great deal of what is sold as penetration testing is a scanner run with a report template on top, or a model instructed to attack something and whatever it returned passed along. Tooling has its place and ArcTech uses it to cover ground faster, never as the deliverable: every finding is reproduced and validated by hand, by someone who understands how the exploitation path was built, before it reaches your report. A fully manual engagement is available on request, with nothing about your environment processed by a model and nothing leaving ArcTech's network. The methodology is published below, and you are not billed for false positives.
€8 500–26 000 · 1–3 weeks · scope-dependent
- Scoping and rules of engagementWritten authorization, scope boundaries, test windows, emergency contacts and the agreed procedure if something critical is found mid-test. Signed before any traffic is generated.
- Reconnaissance and intelligence gatheringOpen-source intelligence, exposed infrastructure, technology fingerprinting and anything reachable that was not on the asset list. Follows PTES pre-engagement and intelligence-gathering phases.
- Enumeration and mappingSystematic mapping of the attack surface: hosts, endpoints, parameters, roles, identities and trust relationships. Automated tooling contributes here, and its output is treated as a list of things to look at rather than a list of findings.
- Manual vulnerability analysisAuthenticated testing role by role against OWASP WSTG and the OWASP Top 10 and API Top 10, plus configuration and authorization logic. This is where business logic and access-control flaws are found, and it is the phase a scanner cannot perform.
- Exploitation and proof of conceptConfirmed findings are chained into the paths that reach something of value, privilege escalation, lateral movement, data access, with evidence captured at each step. Destructive techniques are excluded unless you request them in writing.
- Reporting and risk analysisAn executive summary written to be read by people who are not engineers, and technical findings with full reproduction steps for the people who are. Each finding is ranked by the attack path it enables and the business impact at the end of it, not by a scanner's severity label.
- Walkthrough and retestA live session with your engineers to work through the findings and the fixes, and a free retest of every finding within 30 days to confirm the remediation holds.
- Executive summary and full technical report
- Reproduction steps and evidence for every finding
- Findings ranked by attack path and business impact
- Remediation guidance per finding
- Free retest within 30 days
Questions people ask
How is this different from an automated or AI-driven pentest?
Automated platforms are good at breadth and at known, pattern-matchable issues, and they are considerably cheaper. What they cannot do is understand what your application is for. A model is matching against public material, and the flaws worth finding in a bespoke application are not in that material: one role reading another customer's records, a workflow step that can be skipped, a price set on the client side, three medium findings that chain into domain compromise. Those are found by someone who knows how an exploitation path is built, not by instructing a tool to attack something and forwarding what it returns. ArcTech uses tooling to cover ground faster, and a human decides what any of it means. If breadth at low cost is genuinely what you need, those products are a reasonable purchase and that will be said on the call.
Can the test run with no AI involved at all?
Yes, and it is a stated option rather than a favour. On a fully manual engagement no part of your environment, code, configuration or findings is processed by a model of any kind, and nothing leaves ArcTech's own network. Where tooling that assists analysis is used at all, it runs on hardware ArcTech owns and operates in Finland, never a third-party service. Either arrangement can be written into the engagement terms, which matters when your own client agreements restrict third-party processing or your sector expects to be told exactly where data went.
What methodology do you follow?
OWASP Web Security Testing Guide for application work, the OWASP Top 10 and OWASP API Security Top 10 as coverage baselines, PTES for engagement structure, and NIST SP 800-115 for technical assessment practice. The phases above are the actual sequence, and the report states which parts of each standard were covered and which were out of scope.
Will testing disrupt production?
The rules of engagement define what is in scope, when testing runs and who to contact if anything looks wrong. Destructive techniques, denial of service, data modification, password spraying against live accounts without agreement, are excluded unless explicitly requested in writing.
What if you find nothing serious?
You receive that in writing, with the coverage documented so it is clear what was examined and to what depth. A report stating that a well-built system resisted a competent attacker is a legitimate result and a useful piece of evidence for auditors, insurers and customers.