Penetration Testing
Penetration testing (often called a “pentest”) helps organisations identify, assess and remediate security weaknesses before malicious actors exploit them. It is part of the wider field of offensive security, which covers two complementary disciplines: vulnerability assessment (which weaknesses exist) and penetration testing (whether those weaknesses can actually be exploited). Below we explain how they differ and which one to choose.
Vulnerability assessment vs. penetration testing
The two terms are often confused, although they deliver different results at different costs. In short:
| Vulnerability assessment | Penetration testing | |
|---|---|---|
| Question | Which weaknesses exist? | Can they actually be exploited, and with what impact? |
| Method | Automated / semi-automated scanning + expert review | Manual exploitation following OWASP WSTG, PTES, NIST SP 800-115 |
| Outcome | Prioritised list of potential weaknesses | Confirmed attack chains with PoC and CVSS |
| Best for | A fast, cost-effective first look at your security | Mature products and compliance requirements |
Vulnerability Assessment
A vulnerability assessment is the process of detecting and evaluating vulnerabilities in IT infrastructure, networks, applications and systems. It is carried out automatically or semi-automatically using specialised commercial tools. The results are not just a machine-generated report: our experts review them manually, remove false positives and group the issues by severity, so you know where to start.
This approach quickly and efficiently uncovers a large share of vulnerabilities at relatively low cost. It shows which weaknesses exist in your systems and helps you prevent potential attacks.
Our vulnerability assessments cover:
- Web application assessment (OWASP Top 10, automated DAST): Dynamic application security testing with automated commercial DAST tools. The core assessment is performed without prior knowledge of the source code, and the scan also includes testing with one authenticated user account. This shows which vulnerabilities are reachable by logged-in users. Such scanning efficiently identifies known software flaws, insecure server configurations and outdated components.
- External perimeter and internal network assessment: Security analysis of internet-facing and internal devices and servers. Using the commercial Nessus vulnerability scanner, we look for open ports and assess running services, and determine from software versions whether systems are vulnerable. Importantly, no exploitation or intrusion is attempted at this stage: all weaknesses found are documented in the report as potential threats and vulnerabilities.
Penetration Testing
While a vulnerability assessment shows potential weaknesses, a penetration test reveals whether they can actually be exploited in practice and how your existing defences respond.
It is an in-depth security testing process in which our cybersecurity specialists (ethical hackers) actively attempt to exploit vulnerabilities and attack vectors. The goal is to assess how real threat actors could compromise your systems, gain unauthorised access to infrastructure or exfiltrate sensitive information (customers' personal data, financial records, intellectual property). We do not just identify weaknesses: we confirm that they are exploitable, assess the potential financial or reputational impact on your business and demonstrate attack chains, where several minor weaknesses lead to full system compromise.
Testing follows recognised international methodologies and good practice (OWASP WSTG). We recommend running it periodically (for example once a year) or after significant changes to system architecture or code.
Our penetration testing services include:
- Web application penetration testing: Thorough manual testing according to the OWASP WSTG (Web Security Testing Guide). This standard defines a far broader and more detailed set of vulnerabilities than the well-known OWASP Top 10. Unlike automated scanning, our engineers look for issues that scanners cannot see: complex business logic bypasses, race conditions, deep weaknesses in authentication protocols (e.g. OAuth 2.0, JWT, SAML) and privilege escalation (when an ordinary user gains administrator rights or access to other customers' data).
- Breaching DMZ systems: Simulated attacks targeting publicly accessible applications. By exploiting their vulnerabilities (e.g. RCE or SQLi), we aim to gain access not only to sensitive information or databases on the same server. The main goal is to prove whether a compromised server can be used as a foothold to pivot to other servers or subnets in your DMZ (demilitarised zone).
- Breaching the internal network: This covers everything in the DMZ scenario above, with additional objectives. First, we attempt to pivot from the compromised DMZ directly into the organisation's internal network. If that fails, or if the applications are hosted outside the company perimeter, we simulate internal network access through other attack vectors: targeted phishing, Wi-Fi attacks or physical security. The ultimate goal is to demonstrate whether the most critical business data and the company's identity management core (Active Directory) can be compromised. This comprehensive scenario is for organisations that want to know exactly where their defences are weakest. Although it is the deepest test we offer, it is performed entirely safely: we only run commands that clearly prove a vulnerability exists, without causing any damage to infrastructure or data and without disrupting operations.
Prices
Atakos vektorius, 2026 (EUR, excluding VAT):
Service duration is counted from when we receive authorisation to test and the required credentials or VPN access.
Tool licences: All prices fully include work with professional commercial tools (commercial DAST, Tenable Nessus, Burp Suite Professional and others); the client does not need to buy or rent any licences.
For how our prices compare with the wider market (public sector procurement, the private market, and Germany, Poland and the US), see our study “How much does penetration testing cost in Lithuania in 2026?”.
Vulnerability assessment
| Service | Price | Details |
|---|---|---|
| Web application, following the OWASP Top 10 methodology | 2,000 | Duration: 4 days. Automated DAST with several roles; specialist review; report in Lithuanian or English with findings and recommendations. |
| External perimeter: up to 60 network devices and servers | 2,500 | Duration: 1 week. Commercial vulnerability scanner; specialist assessment report in Lithuanian or English with findings and recommendations. |
Penetration testing
| Service | Price | Details |
|---|---|---|
| One web application, following OWASP WSTG | 3,000 | Duration: 2 weeks. Hybrid DAST; certified specialist; commercial tools; testing of up to three user roles; report in Lithuanian or English with PoC and CVSS; retest within 2 weeks; NDA. |
| Breaching DMZ systems through web application vulnerabilities, and deeper penetration through system, service configuration, access control and network layer weaknesses | 7,500 | Duration: 1 month. Highly qualified certified specialist, commercial tools; report in Lithuanian or English with PoC and CVSS; retest within 30 days; NDA. |
| Breaching the internal network: a wider range of attack vectors, not only web applications in the DMZ but also social engineering, Wi-Fi or third-party systems (up to 60 devices) | 15,000 | Duration: up to 2 months. Highly qualified certified specialist and tester, commercial tools; report in Lithuanian or English with PoC and CVSS; retest within 30 days; NDA. |
| Breaching the internal network through web applications, social engineering, Wi-Fi, DMZ or third-party systems (up to 250 devices) | 20,000 | Duration: up to 4 months. Highly qualified certified specialist, project manager, commercial tools; report in Lithuanian or English with PoC and CVSS; retest within 30 days; NDA. |
Frequently asked questions
What is the difference between penetration testing and a vulnerability assessment?
A vulnerability assessment uses automated tools to find which weaknesses exist and prioritises them. A penetration test manually attempts to exploit those weaknesses and confirms their real impact, demonstrating attack chains with proof of concept (PoC) and CVSS scoring.
How long does a penetration test take?
It depends on the scope: a single web application takes about 2 weeks, infrastructure or internal network scenarios take from 1 month to several months. Time is counted from when we receive authorisation to test and the required access.
Is a retest included?
Yes. Penetration testing services include a retest in which we verify that the findings were properly fixed. The retest window for each service is listed in the price table.
Which methodology do you follow?
We follow recognised international methodologies: web applications are tested according to the OWASP WSTG (Web Security Testing Guide), together with PTES and NIST SP 800-115 good practice. The report contains findings, PoC, CVSS scores and concrete recommendations.
Is testing safe for my systems?
Yes. Even in the deepest scenarios we only run commands that prove a vulnerability exists without damaging infrastructure or data and without disrupting operations. We sign an NDA before any work starts.
Are testing tool licences included in the price?
Yes, fully. We use industry-grade commercial tools (such as commercial DAST scanners, Tenable Nessus and Burp Suite Professional), whose annual licences cost over EUR 15,000. All software, its maintenance and the specialist's work are already included in the fixed price; the client does not need to buy any licences.
How to order
If you are considering penetration testing or a vulnerability assessment to identify and evaluate your organisation's weaknesses and strengthen your systems against real threats, book a free 15-minute consultation or write to us at saugu@atakosvektorius.lt, and we will discuss the best testing strategy for your needs.