External network
Everything reachable from the internet: firewalls, VPNs, remote-access portals, mail servers and exposed services.
Penetration testing: scoped, performed and retested
Penetration testing is an authorised, simulated attack on your systems that finds the weaknesses a real attacker would use, before one does. Arke Technologies, in Johannesburg, scopes, performs and retests penetration tests for South African organisations, public bodies and schools, and helps your team fix what the test finds.
What is a pen test?
A pen test (short for penetration test, also written pentest) is a controlled attempt to break into a system with the owner's written permission. Pen testing uses the same techniques as criminals, which is why it is also called ethical hacking, intrusion testing or, informally, penetration hacking; the differences are authorisation, a defined scope and a report.
Penetration testing and ethical hacking sit within the wider field of security testing. IT security testing also includes vulnerability scanning and code review; a penetration test goes further by proving which weaknesses can be exploited. Penetration testing is the closest you get to an attack without suffering one, which is why it anchors the testing side of our cybersecurity services.
Organisations commission a pentest before go-live, after major change, for an audit, tender or customer requirement, or on a regular cycle.
What we test
We scope each test to the systems that matter to you. Common targets:
Internal network and Active Directory
An AD pentest assumes an attacker has a foothold, such as one phished laptop, and tests how far they can move: Windows pentesting, privilege escalation and paths to domain administrator.
Websites and web applications
Website penetration testing follows OWASP guidance: authentication, sessions, injection, access control and business logic. Web pentesting covers customer, citizen and learner portals; a WordPress pentest adds the plugins and themes WordPress sites depend on.
APIs and software
Software penetration testing (software pen testing) of applications you build or buy, including REST and GraphQL APIs; a GraphQL pentest checks for over-exposed schemas, missing authorisation and query abuse.
Cloud
Penetration testing on Azure, AWS and Google Cloud focuses on identity, storage exposure and misconfiguration. Microsoft lets customers test their own Azure resources without asking first, provided they follow its rules of engagement.
Code and pipelines
A GitHub pentest looks for secrets committed to repositories, weak branch protection and build pipelines an attacker could hijack.
Servers, databases and containers
Linux servers (Ubuntu, Debian, AlmaLinux), Microsoft SQL Server databases (an MSSQL pentest), data stores such as Redis that should never answer without authentication, and Kubernetes container platforms.
Wi-Fi and people
Wireless networks, guest-network separation and phishing simulations that test staff rather than systems. See email security.
Penetration testing tools, and why judgement matters more
Penetration testing tools are easy to obtain. Penetration testing with Kali Linux, the open-source distribution built for security testing, puts hundreds of them in one place: scanners, web proxies, password crackers and exploitation frameworks. Most are open source, which is why pentesting with Kali, or another Linux distribution, is where most testers learn.
Tools find candidates; people find attack paths. A scanner reports a missing patch; a tester chains it to a weak password and an over-privileged account and shows the route to your finance data. Pentesting and criminal hacking differ in authorisation and intent, not technique, so the value of a test lies in the judgement of the person running it.
The penetration testing report
A good penetration testing report serves the executive who funds the fixes and the engineer who makes them. Our pentest reporting includes:
- A plain-language executive summary: overall risk, the most serious findings and what to do first.
- Scope, method, dates and any limits on testing.
- Each finding with a severity rating, evidence, affected systems and steps to reproduce it.
- Prioritised remediation advice, and the attack paths that chain findings together.
- Retest results recorded against each finding.
Reports are encrypted and shared only with named recipients. The report, the evidence and the retest results are yours to keep and to give to auditors, insurers or a tender panel, including after any agreement with us ends. For clients under a managed agreement, open findings are tracked in the monthly service review until closed, so the audit committee sees progress, in line with King IV Principle 12 and, for public bodies, PFMA and MFMA risk-management duties.
Who tests: certifications and experience
Professional penetration testing is only as good as the pen tester doing it, so ask who will test and what they hold. Certifications for penetration testing are a useful first filter: OffSec's OSCP, CREST's practitioner and registered tester exams, GIAC's GPEN and EC-Council's Licensed Penetration Tester (LPT), which is usually what "licensed penetration tester" means. A certified penetration tester has passed a demanding exam; one with years of varied work has also seen what exams miss. The certifications of the testers on your engagement are listed in our proposal.
A junior (jr) penetration tester is normal in any testing team, provided a senior reviews every finding, so ask who reviews. Some organisations build the skill in-house instead: job boards such as Indeed list penetration tester roles, and Penetration Testing: A Hands-On Introduction to Hacking, by Georgia Weidman, is a common first text. But one in-house penetration tester, ethical hacker or not, rarely covers networks, web, cloud and Active Directory in depth, and is never independent of the team that built the systems.
Choosing among penetration testing companies
Penetration testing companies in South Africa range from specialist boutiques to large consultancies. Whichever pen testing companies you shortlist, ask:
- Who tests, and are they independent? If we also run your environment, we agree at scoping how the test stays independent of the people who manage it.
- What is in scope? A cheap test of one address tells you little.
- Is it manual testing or a scan with a new cover page, and is a retest included?
- How is our data handled? POPIA applies to any personal information a tester sees. See POPIA compliance.
- Does the provider meet our procurement requirements? Arke is a Level 1 B-BBEE contributor (sworn affidavit available on request); company documents, CSD supplier number and tax compliance status are available on request, and a test can be bought on a proposal, a purchase order or a tender response. See company facts.
A penetration testing service can be bought per test or as a recurring programme; recurring, platform-led testing is often sold as penetration testing as a service (PTaaS). Either way, one contract with us covers scoping, testing, reporting and retest; a virtual CISO can own the programme, and findings that monitoring missed feed into managed detection and response.
What a penetration test costs
Last reviewed: September 2026.
A penetration test is quoted per project once the scope is clear. The price follows the number of systems and addresses, the type of testing (external, internal, web application or cloud), black-box or white-box testing, the number of user roles in an application and whether a retest is included. We send a written scope and quote after a short call; our penetration testing cost guide explains the drivers.
