Reveal your vulnerabilities with Pentest by Ziwit

A pentest, or penetration test, is a simulated computer attack carried out by a security expert. Its aim is to identify vulnerabilities and weak points in a computer system, web application or network.

Pentest by Ziwit

  • Team of certified and experienced IT security experts. Ziwit is PASSI certified by ANSSI.
  • Manage your sensitive data with confidentiality and security.
  • Pentests customized to your needs, your context and your company. Different types of tests available ( black box, grey box, white box , internal, external).
  • Detailed, usable reports for a better understanding of risks.
  • Concrete, actionable recommendations for improving safety. Follow-up and assistance in implementing corrective measures.
PASSI security VISA

Ziwit positions itself as a trusted partner for your pentesting needs, offering proven expertise, a rigorous methodology and a personalized approach to guarantee the optimal security of your information system.

Request for your free quote!

Our experts can help you carry out your pentest. Contact us for a free estimate.


They carry out Pentests by Ziwit

V & B
Air Caraïbes
Best Western
Famille Michaud
Frans Bonhomme

Why Pentest by ZIWIT ?

Why do a Pentest by ZiwitSpecialized in offensive cybersecurity and pentests for more than 10 years.

Why do a Pentest by ZiwitConsultants and pentesters specialized for each field of intervention (OSINT, Pentest web, hardware intrusion test, infrastructure, AD, wifi, etc.).

Why do a Pentest by ZiwitRecognized as experts by the largest organizations.

Why do a Pentest by ZiwitAn support before (presentation of the pentesters), during (continuous communication) and after the penetration test (advice, support, etc.).

Why do a Pentest by ZiwitA unique contact allowing to follow your projects from start to finish.

The Pentest by Ziwit

What is a Pentest ?

A pentest is a computer security assessment method that simulates a computer attack to identify vulnerabilities and weaknesses in a computer system,a web application or a network.

It is therefore an in-depth and pragmatic audit of the security of a computer system.

Unlike a traditional security audit, which consists of a static assessment of security controls, the pentest simulates attacks under real conditions and uses advanced techniques to test the resistance of a system. Penetration testing is therefore an effective tool to identify vulnerabilities and weaknesses in your applications, infrastructures and IT systems, so that you can correct them.

For over 10 years, Ziwit has been performing daily penetration tests for all types of companies. Specialized in offensive cybersecurity, we are committed to providing the best technical skills to our customers.

Why make a Pentest ?

Computer attacks are becoming increasingly common and sophisticated, and companies need to be prepared to deal with these threats.

Penetration testing in real conditions allows you to discover security flaws, vulnerabilities, feature abuse and configuration issues in your systems, but above all it allows you to fix these flaws before they are exploited by hackers.

In short : pentesting measures the risk associated with an information system by simulating realistic attack conditions, in order to identify ways to significantly reduce it.

What a pentest allows you to ?

Verifying Perimeter Security

Pragmatically and effectively verify the security of a scope (application, infrastructure, cloud, website, etc.).

Demonstrate the security level of an application

Demonstrate the security level of an application to stakeholders (Ziwit CS certificate and certification seal).

Comply with regulatory requirements

Comply with regulatory requirements and security standards (ISO27001, HDS, HIIPA, SOC2, PCI-DSS, etc.).

Develop team skills

Raise the skills of internal teams (awareness through concrete cases involving all employees concerned).

How does a penetration test work ?

4 complementary steps

First contact
The tests to set up

Our experts help you determine the tests to set up in your organization according to your procedures and needs. It can be a test on your internal networks, your applications or your infrastructure.

Information collection
The different Pentests modes

To launch a Pentest, our experts must determine an intrusion test approach. This consists in giving more or less extensive access rights to the ethical hacker.

Discover vulnerabilities

Security vulnerabilities that can be exploited by a real hacker are highlighted for you. All the vulnerabilities identified by our hackers are really exploitable by a malicious hacker.

Reporting & Support
Full reporting

To go further than a vulnerability report, our experts will provide a real summary of the vulnerabilities detected but also the countermeasures for each of them.

How a Pentest by Ziwit works

Conduct of a Pentest by Ziwit


The Kick-off, also known as the scoping phase, is an essential preliminary stage in the success of the operation. This meeting brings together all stakeholders to establish a common understanding of the test objectives, methodologies and timetable.

Key points addressed during this phase include:

  • Detailed presentation of the project and its precise objectives.
  • Rigorous definition of the test perimeter, specifying the systems, applications and networks to be examined.
  • Selection of the most appropriate test methodologies, according to the specific needs of the project (black box, white box, grey box, internal, external).
  • Draw up a precise, realistic timetable for the entire pentest process.
  • Clearly defined rules of engagement governing communication, reporting and interaction between stakeholders.
  • Detailed presentation of the state-of-the-art tools and techniques that will be used to guarantee test effectiveness.
  • Clarification of the role and responsibilities of each stakeholder for optimal collaboration.

Information gathering

The information-gathering phase, also known as reconnaissance, is an important stage in the pentest process. It aims to gather as much data as possible on the target in order to :

  • Identify potential vulnerabilities.
  • Understand system and application architecture.
  • Identify technologies and software used.
  • Identify users and user groups.
  • Map networks and services.

The information-gathering phase is an essential part of the pentest, as it enables:

  • Refine targets and test priorities.
  • Identify potential attack vectors.
  • Adapt test methodologies to target characteristics.
  • Increase the chances of a successful pentest.

Analysis & Audit

The audit and in-depth analysis stage is a central element of the pentest process. It is at this stage that pentesters exploit the information painstakingly gathered during the reconnaissance phase to identify, assess and exploit the target's vulnerabilities and security holes.

This crucial phase consists of several distinct stages:

1. Methodical analysis of collected data

  • Rigorous sorting and classification of collected information.
  • Precise identification of potential vulnerabilities, based on recognized taxonomies and methodologies.
  • In-depth assessment of the criticality of vulnerabilities, taking into account their potential impact on the target.

2. Targeted, rigorous penetration testing

  • Methodical exploitation of identified vulnerabilities, using techniques and tools adapted to each type of flaw.
  • Sophisticated intrusion attempts into the system or application, simulating real attacks.
  • Accurate assessment of the real impact of vulnerabilities, by measuring the extent of potential damage.

3. Comprehensive analysis of results

  • Methodical and detailed compilation of intrusion test results.
  • Precise identification and mapping of weak points in safety, based on relevant metrics and indicators.
  • Objective, quantified assessment of the overall level of risk associated with the target.


Penetration test report

The reporting phase aims to communicate the results of the analysis in a clear, concise and usable way to stakeholders. A well-written pentest report enables:

  • Understand identified vulnerabilities and their severity.
  • Measure the potential impact of security vulnerabilities on the organization.
  • Prioritize corrective actions.
  • Improve the company's overall security posture.

The pentest report must contain the following elements:


  • Summary of the project and its objectives.
  • Scope of pentest.
  • Methodologies and tools used.

Detailed results

  • Detailed description of identified vulnerabilities.
  • Proofs of exploitation (screenshots, logs, etc.).
  • Severity and potential impact of each vulnerability.


  • Concrete solutions to correct security vulnerabilities.
  • Estimation of resources and time required for correction.
  • Prioritization of corrective actions.
  • Assistance in correcting detected vulnerabilities


  • Summary of the report's key points.
  • Overall risk level associated with the target.
  • General recommendations for safety improvement

In addition to these elements, the report may also include:

Technical appendices

  • Detailed information for security experts.
  • Penetration test results.


Définition of technical terms used in the report.


The counter-audit is an important step. Its main objective is to validate that the identified vulnerabilities have been corrected, and to ensure that the corrective measures implemented are effective. What's more, it enables us to identify any harmful side-effects of the corrective measures.

At Ziwit, we remain at your disposal to help and guide you in correcting and remedying any reported flaws.

The counter-audit ensures that:

  • Vulnerabilities have been correctly identified and understood.
  • The remediation solutions implemented are adequate and effective.
  • Risks related to vulnerabilities have been effectively reduced.

The counter-audit is an essential step for several reasons:

  • It builds confidence in the security posture of the organization.
  • It ensures that security investments are profitable.
  • It helps identify possible gaps in the vulnerability correction process.
  • It contributes to the continuous improvement of the security posture.

Our areas of intervention

Web Pentest

Penetration test on your websites and web applications, to evaluate their robustness and security status (web vulnerabilities, configuration problems, abuse of features, escalation of horizontal and vertical privileges, etc.).

Mobile Application Penetration Test

Audit of your mobile applications (Android and IOS) and their constitution (application layer, configuration, data exchanges and security, webservices and related APIs, etc.). A static audit and a dynamic audit are performed.

Exposed Infrastructure Pentest

Penetration test on the elements of your infrastructure that you expose, to obtain a visibility on the various access points to your infrastructure (applications, file servers, mail servers, VPN access, remote access, exposed network equipment, etc.). This audit is generally performed in “Black Box”.

Infra and Network Pentest

Pentest on your internal infrastructure, allowing to evaluate the possibilities of malicious acts by a hacker with access to the company's internal network (compromise of a workstation, compromise of the exposed and pivotal infrastructure, physical attack, access to the network, etc.).

Reconnaissance Audit and OSINT

The reconnaissance audit provides visibility on the various information available on the targeted company (confidential documents, employee IDs and passwords, IPs, shadow It, databases, etc.). The information is then cross-referenced to define the risks related to them.

A specific OSINT department and tools developed internally (CYBERVIGILANCE By HTTPCS) allow us to be particularly effective on these audits.

Global Security Audit

Audit of all your scopes :

  • Information exposed on the internet or on malicious forums (OSINT)
  • Assets and Exposed Infrastructure
  • Shadow IT
  • Pentest exposed infrastructure
  • Focus on sensitive exposed assets
  • Internal infrastructure pentest-type audit on physical sites

This audit provides general visibility of your security status (external and internal).

IOT Pentest

Penetration test on the different layers (hardware, software, interfaces, links, network, etc.) constituting the connected object. Different auditors are solicited on these missions: hardware and software pentester.

The main purpose of a connected object pentest is to detect the flaws present on the different layers in order to secure the entire environment of the connected object.

Red Team

The RedTeam audit simulates attacks targeting the company, and allows multiple scenarios. Where a pentest targets a particular scope, we will use several methodologies (phishing, social engineering, pentest, physical intrusions, use of data available on open sources, etc.) allowing us to validate the sources of risks and to test the internal teams (often considered as defenses in Blue Team).

Pentest by Ziwit customer testimonials

We have selected 3 testimonials from various customers who have carried out a Pentest in the last 6 months at Ziwit.

CIO of a banking company

« We carried out a pentest with Ziwit to assess the security of our IT infrastructure. The Ziwit team was very professional and efficient. They identified several critical vulnerabilities that we would not have been able to detect on our own. Thanks to their expertise, we were able to implement corrective measures to protect our sensitive data and prevent cyber-attacks. I highly recommend Ziwit's services to any company looking to strengthen its IT security. »

IT security manager for an e-commerce company

« We called on Ziwit to carry out a pentest of our e-commerce website and back-office. The aim was to guarantee the security of our customers' transactions. The Ziwit team did a thorough job and identified several security flaws. We were able to correct them quickly thanks to the precise and concrete recommendations provided by Ziwit. We are very satisfied with Ziwit's service. »

CIO of a public-sector administration

« As part of a project to modernize our information system, we decided to carry out a pentest with Ziwit. The Ziwit team was able to adapt to the specific requirements of our sector, and produced high-quality work. They identified several areas for improvement and helped us implement corrective measures. Ziwit's final report is a valuable tool for managing our IT security. We're very satisfied with their collaboration and won't hesitate to call on them again. »

Request for your free quote!

Our experts can help you carry out your pentest. Contact us for a free estimate.

Your satisfaction and security are our priorities. Contact us

Contact us!

+33 1 85 09 15 09