As cyber attackers get more cunning and persistent, it's vital for organisations to develop and maintain a robust infosec program, giving them the flexibility to assess their environments as often as they need.
Small and medium-sized businesses (SMBs) across Aotearoa are embracing the latest tech developments, like AI, cloud computing, and the Internet of Things (IoT). However, many don't consider the security risks that come with digital transformation, leaving them open to cyber theft, scams, and a whole bunch of other cybercrimes. In fact, two-thirds of SMBs experienced a security breach last year, with the average cost per incident being a whopping $600,000! So, it's more important than ever for SMBs to make cyber security a top priority.
We're flexible with our scheduling. Just let us know when you want us to run your pen test, and we'll lock it in, no dramas.
We'll keep you in the loop when the pen test starts and stops. This way, you'll know if any alerts are triggered and can take action if needed.
Our reports are chock-full of valuable info, like how risks impact your organisation, where you stand compared to others, and how things have changed since your last assessment.
Our prices are competitive compared to traditional pen testing firms, but you'll get even more bang for your buck.
Your IT contact can log into their portal anytime to see who's involved, chat with our consultant, and get progress updates with preliminary results and expected completion dates.
With all activities tracked, including any manual tasks by our consultant, your organisation can download the activity log and match it with your SIEM and incident response procedures. This helps you fine-tune your controls and speed up detection and response times.
DON'T LEAVE YOUR ORGANISATION VULNERABLE TO CYBER THREATS
Reach out to us today and take control of your security with our top-notch automated penetration testing services
A vulnerability assessment is like noticing your door's unlocked - it simply alerts you to the problem. On the other hand, a penetration test goes a step further, showing you what could happen because of that unlocked door: finding an open safe, unsecured valuables, credit cards, and personal info scattered about. Plus, it offers advice on securing the door, protecting sensitive data, and more
Scope and Methodology
At Bluehex, we offer a range of security assessments, including vulnerability assessments and penetration tests, to help organisations stay on top of their cyber security game.
“External Network Penetration Test.”
Our comprehensive approach identifies security vulnerabilities in both internal and external systems, with the exception of using Open-Source Intelligence (OSINT) for external tests. Our consultants employ various resources and techniques to identify, enumerate, and exploit targeted systems, including:
We gather intel about your organisation’s environment using publicly accessible sources like doppelganger domains, IP address ranges, usernames, Shodan vulnerabilities, and metadata from files. We also analyse public DNS records to spot valuable info for potential attacks.
We use ping sweeps and port scans with tools like Nmap and Masscan to identify active systems within provided ranges. These hosts are then used for enumeration, exploitation, and post-exploitation.
Based on open ports found during host discovery, we enumerate info using tools like Nmap, Metasploit, Hydra, and our proprietary tools. We also analyse network-layer traffic for vulnerabilities, such as exploitable broadcast protocols.
If a security vulnerability is found during enumeration, we attempt to exploit it to gain remote command execution on the compromised system.
After compromising a system externally, we perform internal penetration test steps to gain further access to the internal network environment, including pivoting, privilege escalation, and lateral movement.
The only process performed during an external vulnerability assessment is vulnerability analysis. We scan all internet-accessible systems for known vulnerabilities, using severity rankings and data from the scanner, without altering any information
Internal Network Vulnerability Assessment
Similar to the external assessment
We perform vulnerability analysis by scanning all systems accessible within the internal network environment for known vulnerabilities, using severity rankings and data from the scanner, without altering any information
