Penetration Testing
Professional Penetration Testing Services
Real-world attack simulations against your websites, APIs, mobile apps, and networks to uncover security gaps before attackers do.
What you get
- Executive summary for management
- Full technical report with proof of concept (PoC)
- CVSS-based risk scoring
- Remediation recommendations for each finding
- Results walkthrough session with your team
- Retest report & testing attestation letter
Overview
What is Penetration Testing?
Penetration testing (pentesting) is a security assessment in which our ethical hackers attempt to breach your systems using the same techniques as real attackers. The result is not just a list of vulnerabilities, but proof of real-world impact and clear remediation priorities.
iKodora combines vulnerability assessment and penetration testing (VAPT) using methodologies based on the OWASP Testing Guide, OWASP MASVS, and PTES, so test coverage is thorough and the results stand up to audit and compliance requirements.
Service Scope
Penetration Testing scope
Pick what you need, or combine them for complete protection and results.
01
Website & Web Application Pentesting
Web application testing against the OWASP Top 10: injection, broken access control, authentication, and business logic.
- Attack simulation
- Business logic testing
- Detailed risk report
02
API Pentesting
REST & GraphQL API testing against the OWASP API Security Top 10, including BOLA and mass assignment.
- Per-endpoint authorization
- Rate limiting & abuse
- Input validation
03
Mobile Application Pentesting
Android & iOS app testing based on OWASP MASVS: data storage, communication, and reverse engineering.
- Static & dynamic analysis
- Local storage security
- Certificate pinning
04
Network & Infrastructure Pentesting
Internal and external network testing to uncover exposed services, misconfigurations, and lateral movement paths.
- External & internal network
- Active Directory
- Wireless security
Pricing
Transparent starting prices
Fixed price agreed after a free scoping call. No day-rate surprises, no change orders mid-test.
Web app
Up to 10 core features
Starting from
USD 5,600
API
Up to 20 endpoints
Starting from
USD 4,700
Mobile app
≤ 10,000 users
Starting from
USD 7,600
Network
Up to 16 IPs
Starting from
USD 6,600
Benefits
Why your business needs Penetration Testing
- 01
Find gaps first
Know your system's weak points before malicious actors exploit them.
- 02
Audit & compliance ready
Reports support ISO 27001, Indonesia's Personal Data Protection Law (UU PDP), OJK regulations (POJK), and PCI DSS.
- 03
Clear remediation priorities
Every finding comes with a risk rating (CVSS), evidence, and technical recommendations.
- 04
Retest after remediation
We retest findings to confirm your fixes are truly effective.
Process & timeline
From first call to final report in about 3 weeks.
Best-practice timeline for a single-application scope. Every stage has a clear output, and critical findings never wait for the final report.
01Scoping call
Days 1–2
A 20-minute call to map assets, goals and compliance drivers. Mutual NDA signed before technical details are shared.
02Proposal & rules of engagement
Days 3–4
Fixed price, schedule, testing windows in your timezone, emergency contacts and written authorisation.
03Preparation & kickoff
Day 5
Test accounts, staging access if needed, our fixed source IPs for whitelisting, and a short kickoff call.
04Active testing
Days 6–13
Manual and automated testing to OWASP/PTES. Critical findings are escalated within 24 hours.
05Analysis & reporting
Days 14–15
Executive summary for leadership, technical detail with proof of concept, CVSS scoring and remediation per finding.
06Debrief call
Day 16
Live walkthrough with your engineers and leadership, including remediation priorities.
07Your team remediates
~1–4 weeks
You fix the findings. We stay available for technical questions throughout.
08Retest & attestation
2–3 days
We verify the fixes and issue a retest report plus an attestation letter for auditors and customers.
- About 15 business days to the final report, then a debrief and a retest once you've fixed.
About 15 business days to the final report, then a debrief and a retest once you've fixed.
04 / 08
Active testing
Days 6–13
Manual and automated testing to OWASP/PTES. Critical findings are escalated within 24 hours.
* The timeline above is an example for a single-application scope. Actual duration still depends on the pentest scope: the number of applications, features and endpoints tested.
Sample report
See the report before you buy.
Written for two audiences: leadership who need the risk in plain English, and engineers who need exact steps to fix it.
- Executive summary
- CVSS risk scoring
- Proof of concept per finding
- Remediation guidance
- Framework mapping
FAQ
Questions about Penetration Testing
Can't find the answer you're looking for? Our team is ready to help.
Starting from USD 4,700. The final price depends on the number of applications, features, endpoints and IPs in scope, and is locked in as a fixed price after a free scoping call.
Typically 1–4 weeks depending on scope: the number of applications, API endpoints, and hosts. We set the exact timeline after scoping with your team.
Black-box testing is performed without internal information (like an outside attacker), grey-box uses limited accounts or documentation, and white-box provides full access including source code. Grey-box usually offers the best balance between realism and depth.
Testing follows agreed rules of engagement. High-risk techniques are only performed with approval, and we can test in a staging environment if needed.
At least once a year, and whenever there is a major change such as a key feature release, an infrastructure migration, or a third-party integration.
Related Insights
Articles on Penetration Testing
Threat trends, best practices, and the stories behind the solutions we build.
Related Services
Round out your protection
Cyber Security
End-to-end protection for your servers, applications, and networks: from hardening and secure code review to 24/7 threat monitoring.
Software Development
Innovative, scalable, and user-friendly web, mobile, and ERP applications, built with security as the foundation from day one.
IT Consulting & Managed Services
Reliable IT planning, implementation, and maintenance, from IT strategy development to efficient 24/7 monitoring.
#LetsSecure
Get the right solution to keep your business secure.
Talk to us about your security or software development needs. The first session is free.
- Email[email protected]
- LocationJakarta, Indonesia
- ResponseWithin 1 business day