Skip to content
NZSNextZen SecuritySecure AI engineering

Service

Penetration Testing and Technical Assurance

Find out what an attacker would actually get. Test your external and internal networks, web, mobile and API surfaces, then fix what matters before someone else finds it.

Who it is for

Organisations that need independent testing evidence for customers, auditors, insurers or their own board.

When clients call

  • A customer or auditor asking for a current penetration test report
  • A significant change to your perimeter, cloud footprint or application estate
  • A previous test whose findings you have fixed and want retested

Scope

  • External and internal infrastructure, web, mobile or API testing as scoped
  • Manual testing led by engaged specialist practitioners, not a scanner report
  • CVSS v4.0 scoring and a prioritised remediation plan
  • Retest of fixed findings, included in the fixed fee

Method and standards

  • OWASP Web Security Testing Guide
  • OWASP ASVS
  • PTES
  • CVSS v4.0

Deliverables

  • Findings register by severity, each mapped to a control
  • Evidence, reproduction steps and remediation guidance
  • Executive readout for leadership
  • Retest report confirming the fixes that closed each finding

Engagement arrangements

Dates, responsibilities and any ongoing review cadence are agreed in the written scope. Retesting is included where stated in that scope.

What happens after the scoping call

Written scope and fixed-fee proposal within one business day of your scoping call. The scope names the standards applied, the deliverables, the dates and the people doing the work.

Questions

Who performs the testing?+

Engaged specialist practitioners deliver the testing under NextZen scoping and quality assurance, and Shantanuu Roy reviews every report before it reaches you.

Will testing disrupt production?+

Testing is scheduled with you, rate-limited by agreement and stopped immediately on request. Systems that cannot be safely tested are excluded in the written scope.

How is the fee set?+

The written proposal defines the fixed fee, responsibilities and deliverables. Any change to scope is agreed in writing before additional work begins. Ongoing advisory includes an agreed review cadence and availability.

How is our evidence handled?+

Evidence is held under NDA, encrypted at rest and in transit, restricted to the named engagement team and destroyed on the schedule stated in the scope. It is never used to train any model.

Tell us what changed.

Thirty minutes, no obligation. Written scope and fixed-fee proposal within one business day of your scoping call.

Book a Strategic AI Readiness Assessment