External infrastructureWhat the internet can see
Your public IP addresses, firewalls, VPNs, remote access portals and mail servers, tested the way an outside attacker would approach them.
Zarco / Penetration testing
Find the way in before someone else does.
We test your systems the way an attacker would. AI agents do the volume of the work, an experienced tester confirms every finding, and you get a report that tells you what to fix first.
- What we test
- Networks, web apps and APIs, cloud and Microsoft 365
- You get
- A report ranked by severity, with a fix for each finding
- After fixes
- A retest to confirm they worked
- Your contact
- Zarco, from scoping to retest
01What we test
Every way in, tested the way an attacker would.
Most tests combine two or three of these. We'll help you pick what matters for your risk, your customers and your budget.
Internet-facingForgotten systems, known CVEs
Web apps and APIsWho can see whose data
Cloud and identityPermissions, MFA and secrets
AI featuresWhat they can be talked into
Internal networkWhat a foothold could reach
If an attacker got onto one laptop, how far could they get? We test your internal network, Active Directory and file shares from the inside.
Web applications and APIsYour customer-facing systems
Portals, booking systems, e-commerce and the APIs behind them, tested for broken authentication, injection, data exposure and logic flaws.
Cloud and Microsoft 365Where most businesses now live
Microsoft 365, Entra ID, Azure and AWS configuration: sharing settings, conditional access, admin roles and the gaps between them.
02Sample report
See exactly what you get at the end
A plain-English summary for leadership, every finding ranked with its evidence and a fix, and a retest record showing what's been closed. This sample follows a fictional company, Example Ltd, through a full engagement.
Full sample reportContents
Sample report for Example Ltd, a fictional 60-person software company. Not client data.
Zarco sample report
Penetration test report
Example Ltd
Security posture assessment with application and API penetration test
The question askedWhere is the business exposed, and is the customer portal secure?
1Section
Executive summary
- 0Critical
- 4High
- 4Medium
- 3Low
- 1Info
Overall postureAt riskGood, with two items in progressafter retest
Over two weeks, AI agents examined everything Example Ltd shows the internet, its Microsoft 365 tenant and its customer portal, and our testers confirmed twelve findings.
Four were high risk. An old admin portal was still online with outdated software. Three administrator accounts weren't protected by multi-factor authentication. In the customer portal, two weaknesses combined to let one customer download another customer's exports, and sessions stayed active after a password change.
All four were fixed and verified on retest by 30 September. Two lower-risk items are in progress, and one is an accepted risk.
What's working
- Production and staging are well separated.
- The main website and email service are patched promptly.
- Urgent findings were fixed within two days of being raised.
Next priorities
- Finish the invitation fix on the bulk-invite path (ZP-06).
- Move email protection from quarantine to reject (ZP-10).
- Keep an inventory of internet-facing systems and review it quarterly.
2Section
Posture at a glance
| Area | Before | After retest | Why |
|---|---|---|---|
| Internet-facing systems | At risk | Good | The forgotten admin portal is offline. |
| Customer portal and API | At risk | Needs attention | High-severity issues fixed; bulk invites still accept a role from the browser. |
| Microsoft 365 | At risk | Good | Multi-factor authentication now covers every administrator. |
| Cloud storage | Needs attention | Good | Public listing disabled and internal files moved. |
| Code and secrets | Needs attention | Good | The leaked key is revoked and secret scanning is on. |
| Email and domain | Needs attention | Needs attention | Spoofed email is now quarantined; blocking is planned. |
3Section
Findings at a glance
| ID | Severity | Finding | Status |
|---|---|---|---|
| ZP-01 | High | Forgotten admin portal online with outdated software | Fixed |
| ZP-02 | High | Three administrator accounts without multi-factor authentication | Fixed |
| ZP-03 | High | Cross-workspace access to exports | Fixed |
| ZP-04 | High | Sessions survive a password change | Fixed |
| ZP-05 | Medium | Sequential export identifiers | Fixed |
| ZP-06 | Medium | Invitation role accepted from the browser | Partially fixed |
| ZP-07 | Medium | Storage container lists file names publicly | Fixed |
| ZP-08 | Medium | Email-service key in a public repository still valid | Fixed |
| ZP-09 | Low | Detailed error messages | Open |
| ZP-10 | Low | Email domain not fully protected against spoofing | Partially fixed |
| ZP-11 | Low | Password reset links last seven days | Fixed |
| ZP-12 | Info | Older encryption protocols accepted | Accepted risk |
4Section
Scope and approach
In scope
- example.com, its subdomains and the services they expose
- The customer portal and its API: staging, three roles, two test workspaces
- The Microsoft 365 tenant, as a read-only configuration review
- Public code repositories linked to example.com
- Storage buckets that serve the website
Out of scope
- The internal office network
- Staff phishing and physical security
- Denial-of-service testing
- The third-party payment provider
Rules of engagement
- Weekdays, 08:00 to 18:00 UK time
- Portal traffic limited to 4 requests per second
- Anything that could change data held for approval
- A named stop contact on both sides
ApproachAI agents mapped and tested the scope in parallel, with every action checked against the agreed scope before it ran. Our testers steered the work, confirmed every finding and rated its severity for Example Ltd's business, against the OWASP Web Security Testing Guide and the CIS Microsoft 365 benchmark.
5Section
Attack path AP-01
A Viewer in workspace A reads workspace B's documents.
- StartViewer role, workspace AAgreed test identity
- ZP-05, mediumExport IDs are sequentialValid IDs for other workspaces are predictable
- ZP-03, highNo ownership check on exportThe API trusts the ID it's given
- ObjectiveWorkspace B documentsMetadata and signed download links
Two moderate weaknesses combine into one high-impact path. Fixing ZP-03 closes it; fixing ZP-05 alone doesn't.
ZP-03Finding
Cross-workspace access to exports
HighWhat we found
Signed in as a Viewer in one customer's workspace, we could download exports belonging to another customer.
Evidence, request
GET /api/v2/exports/10482 HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOi... # viewer, workspace AEvidence, response
HTTP/1.1 200 OK
content-type: application/json
{ "id": 10482, "workspace": "ws_b",
"name": "Q3 contracts.zip",
"download_url": "https://files.example.com/...[redacted]" }Steps to reproduce
- Sign in as a Viewer in workspace A.
- Request an export ID that belongs to workspace B.
- The API responds 200 with workspace B's document metadata.
Business impact
Any customer could read other customers' documents, which is likely to be a reportable personal data breach.
Root cause
Workspace ownership is enforced in the interface but not in the export service.
Fix
Scope every export lookup to the caller's workspace in the service layer, and add a regression test that fails if it ever isn't.
FixedVerified on retest, 30 September 2026. Cross-workspace export IDs now return 404.
7Section
Retest record
Retested on 30 September 2026, against the fixes Example Ltd deployed.
| ID | Finding | Result | Note |
|---|---|---|---|
| ZP-01 | Forgotten admin portal | Fixed | Portal offline; hostname no longer resolves. |
| ZP-02 | Admins without MFA | Fixed | All administrators covered; exclusions reviewed. |
| ZP-03 | Cross-workspace exports | Fixed | Cross-workspace export IDs now return 404. |
| ZP-06 | Invitation role from browser | Partially fixed | Single invites fixed; bulk invites still accept a role. |
| ZP-09 | Detailed error messages | Open | Scheduled for the October release. |
The report ends with a coverage and limitations appendix, and a letter of attestation you can share with customers, insurers and auditors.
03How a test runs
How a test runs.
Nothing is touched until scope and rules are agreed in writing.
What you're really paying for in a testScope
We agree targets, dates, what's off limits and who to call if something looks wrong.
Test
We work through the scope within the agreed window: AI agents do the volume, our testers steer and confirm. Anything critical is flagged to you straight away.
Report
You get the written report, and we walk your team through it on a call.
Fix and retest
Your team or ours fixes the issues, then we confirm the fixes have worked.
04Pentest or CE+
They answer different questions.
Cyber Essentials Plus confirms that five baseline controls are in place, using a standard audit. A penetration test goes looking for any way in, including the ones no checklist covers.
Customers and insurers often ask for both. We can run them together, so the test finds problems early and the audit passes first time.
Will testing disrupt our live systems?
Testing is designed not to. Anything that could affect a live service is discussed with you first and can be run out of hours or left out of scope. You'll have a named contact throughout the test window.
How long does a test take?
A focused external or web application test typically takes a few days. Larger scopes take longer. You'll have the dates and the length agreed before anything starts.
How often should we test?
At least once a year, and after any significant change, such as a new application, a cloud migration or a merger. Many contracts and insurers set their own requirement, so check yours.
Who are the testers?
We are. Zarco runs every test in-house. AI agents handle the volume of the work, mapping your systems and trying thousands of possibilities, and an experienced tester decides what's real and confirms every finding before it goes in the report.
Talk to us about AI, compliance or testing.
A 30-minute call, a straight answer, and a fixed quote if there's work to do.
→Contact
Tell us what you need.
A tender deadline, an insurer's questionnaire, a system you want tested, or a job you'd like AI to take off your team's hands. We reply within one working day, UK hours.
- A 30-minute first call, with no obligation
- A fixed quote before any work starts
- A UK-based team you can talk to directly