Skip to content
normSight Cyber Security
Menu

Penetration testing · Compliance · Training

We see what an attacker would see, before they do.

We test your network, web, mobile and wireless estate with real attack scenarios, verifying and reporting every finding manually.

Request a Quote Our services
  • Every finding verified manually
  • Reports for executives and engineers
  • Post-remediation retest included
Attack surface · 31 assets · 7 findings Illustrative scenario
Target
10.0.4.121
Finding
Default administrator password
CVSS
9.8 Critical
Status
Verified

Move the lens across the map. Systems that look fine from outside tell a different story up close.

Solutions

Every layer of your attack surface

Tests within a scope agreed in writing, planned so they never disrupt your services.

All solutions
Internal and external network

Network Penetration Testing

We test the servers, clients and network devices on your local network with real attack scenarios, proving the vulnerabilities we find by exploiting them.

View details OWASP Top 10

Web Application Penetration Testing

We test your web application from session management through to the data layer using manual and automated methods, verifying and reporting every finding.

View details iOS · Android

Mobile Application Penetration Testing

We test your iOS and Android applications across data storage, communication and back-end API layers, and measure their resilience to reverse engineering.

View details WPA2 · WPA3

Wireless Network Security Testing

We test the encryption, authentication and network segregation configuration of your corporate Wi-Fi, and measure your exposure to rogue access points.

View details Controlled phishing

Social Engineering Assessment

We measure your employees' information security awareness with controlled phishing scenarios and report the risk in the human layer in aggregate form.

View details Controlled load

DoS/DDoS Testing

We measure your systems' resilience to denial-of-service attacks under controlled load, and report the real effectiveness of your protection solutions.

View details Law No. 6698

KVKK Compliance Consultancy

For compliance with Turkish data protection law no. 6698, we deliver gap analysis, data inventory, technical and administrative measure assessment and a compliance roadmap.

View details CSIRT · Forensics

Incident Response Capability

We build your response capacity through CSIRT set-up, threat hunting and digital forensics.

View details

How we work

A penetration test runs in four steps

What you receive is not raw scanner output but proven findings ranked by business impact.

  1. 01

    Scoping

    We map your asset inventory together and agree the test boundaries and time window in writing.

  2. 02

    Testing and verification

    We exploit findings the way a real attacker would and verify each one manually. Raw scanner output never enters the report.

  3. 03

    Reporting

    An executive summary alongside technical detail, with findings rated by business impact.

  4. 04

    Retest

    Once issues are fixed we test again. This step is part of the engagement.

A page from our report format

Finding NS-26-014 · Page 7 / 32 CRITICAL 9.1

Customer orders exposed through an API endpoint that requires no authentication

Asset
REST API · GET /v2/orders/{id}
Verification
Exploited manually, evidenced with screen recordings
Business impact
Every customer's name, address and order data can be read and modified.
Recommendation
Validate the session and object ownership server-side on every request.
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
FixedConfirmed closed in the retest

Free · 2 minutes

How prepared is your organisation for a cyber attack?

Answer six short questions to see your security maturity, your weak spots and our priority recommendations. Your answers never leave your device.

Start the assessment

Trainings

Training that brings your team up to the attacker's level

Specialist programmes delivered on-site or as live online classes, with hands-on lab access.

Defensive Trainings

Detection, analysis and response

Blue team

Offensive Trainings

Penetration testing and exploitation

Red team
14specialist programmes 2formats: on-site or live online Labhands-on environment in every programme

Blog

Latest articles

All articles

FAQ

Frequently Asked Questions

What is the difference between a penetration test and a vulnerability scan?

A vulnerability scan lists known issues using automated tools. In a penetration test an expert exploits the findings like a real attacker, proving impact and uncovering chained attack paths. Every normSight finding is verified manually.

How long does a penetration test take?

It depends on scope. A single web application typically takes 5-10 business days; a full corporate network 3-4 weeks. A precise schedule is shared after the scoping call.

What is delivered at the end of a test?

A report containing an executive summary, technical findings, evidence screenshots, risk ratings and remediation guidance. A post-remediation retest is part of the engagement.

Are trainings delivered remotely or on-site?

Both. Courses can be scheduled on-site at your organisation or as live online classes; hands-on lab access is provided either way.

What does compliance consultancy cover?

Gap analysis, data inventory and processing records, assessment of technical and administrative measures, review of privacy notices and consent texts, and a prioritised compliance roadmap.

Let's talk about your scope.

Let's work out together which test is right for you. We respond to requests within one business day.

+90 553 808 14 53 [email protected]
Request a Quote Get in touch