What is the difference between an audit and a pentest?

The audit provides a broad, methodical state of play of your security (configurations, processes, compliance) and identifies your weaknesses. The pentest takes an attacker’s perspective and concretely demonstrates which of those weaknesses are actually exploitable and with what impact. The audit answers "where are my flaws?", the pentest "which can be exploited, and how far?".

Is a vulnerability scan enough, or do I need a real pentest?

An automated scan detects known vulnerabilities but generates many false positives and does not demonstrate real impact. A pentest combines tools and human expertise to exploit flaws, rule out false positives, identify business-logic vulnerabilities (invisible to scanners) and demonstrate concrete impact. The scan is a complement, not a substitute.

How long does a pentest take?

Depending on scope, generally from a few days to two or three weeks. A medium-sized web application is often tested in 5 to 10 days. The initial scoping allows a precise estimate based on your objectives and budget.

Does a pentest pose a risk to my production systems?

The test is conducted in a controlled setting, with rules of engagement defined upfront (scope, hours, authorised actions). Where relevant, I test on a pre-production environment. Any actions likely to affect availability are systematically validated with you beforehand.

How often should I run an audit or a pentest?

At least once a year, and at every major change (new application, architecture overhaul, Cloud migration). Many frameworks and enterprise clients require an annual pentest. For a fast-moving SaaS, a more frequent cadence on critical changes is recommended.

Is a pentest required for ISO 27001 certification?

ISO 27001 does not explicitly require a pentest, but technical vulnerability assessment is a strong expectation, and the pentest is the most credible way to meet it. It is also an excellent way to feed your risk analysis with concrete data.

Cybersecurity audit & penetration testing (pentest) for SMBs and SaaS

Audit vs pentest: what is the difference?

The two terms are often confused, but they answer different and complementary questions.

The cybersecurity audit takes a broad, methodical view: it assesses system configuration, processes, governance and compliance with a framework (ISO 27001, ANSSI, CIS). It aims for completeness and coverage.

The penetration test takes the attacker's perspective: it actually attempts to exploit the flaws to demonstrate concrete impact (access to data, server takeover, privilege escalation). It aims for depth and proof.

When to choose one or the other?

Audit: to establish a complete state of play, prepare a certification or prioritise your security investments.
Pentest: to validate the real robustness of an application, infrastructure or SaaS before going live or at a client’s request.
Ideally both: the audit frames the scope, the pentest validates the critical points.

The cybersecurity audit

The cybersecurity audit is a methodical assessment that objectively measures your maturity level and identifies gaps against best practices. Its purpose is not to prove a flaw is exploitable, but to cover your exposure as broadly as possible so nothing stays in the blind spot. An audit can be technical — review of configurations, hardening and exposed surface —, organisational — policies, processes, governance and access management — or focused on a specific framework, in the form of a gap analysis against ISO 27001, ANSSI recommendations or CIS benchmarks. In every case, it produces a ranked snapshot of your risks, readable by both technical teams and management, and an action plan prioritised by impact / effort ratio. It is the logical starting point of any security journey.

What an audit typically covers

Inventory and classification of critical assets
Review of configurations and hardening (systems, network, Cloud)
Management of access, identities and privileged accounts
External exposure and attack surface
Security policies, procedures and governance
Risk analysis and compliance with the target framework

The deliverables

A clear report ranking findings by risk level, readable by both technical teams and management, with an action plan prioritised by impact / effort ratio.

The penetration test (pentest)

The penetration test, or pentest, simulates a real attack in an authorised and controlled setting, to measure the actual resistance of your defences against a determined adversary. Where the audit seeks coverage, the pentest seeks proof: it does not merely flag a potential vulnerability, it actually attempts to exploit it to demonstrate its business impact — access to client data, server takeover, privilege escalation or bypassing application logic. Unlike a simple automated vulnerability scan, which lists theoretical flaws and generates many false positives, the pentest combines tooling and human expertise to separate what is genuinely dangerous from what is not. The result is a concrete, prioritised view of your exposure, based on what an attacker could truly accomplish.

The approaches: black, grey, white box

Black box: the tester has no prior information, like an external attacker.
Grey box: the tester has limited access (a user account, for example) — the best coverage / cost ratio.
White box: the tester has access to code, configurations and architecture, for maximum coverage.

The scopes tested

Web applications and APIs (OWASP Top 10, business logic)
SaaS and multi-tenant applications (data isolation between clients)
External infrastructure (Internet exposure) and internal (lateral movement)
Cloud environments (AWS, Azure, GCP) and containers
Social engineering and phishing (on request)

My pentest methodology

A credible pentest is never improvised: it follows a structured, repeatable approach aligned with the profession's recognised standards (OWASP for the web, PTES for the overall flow, MITRE ATT&CK for attack techniques). This rigour ensures the test is complete, traceable and that its results are comparable from one campaign to the next. Every engagement starts with precise scoping — perimeter, objectives and rules of engagement — to avoid any drift, then progresses from reconnaissance to post-exploitation, before concluding with an actionable report and a re-test of the fixes. The goal is never to "break for the sake of breaking", but to provide proof of impact useful for decision-making. Here are the steps I follow for each engagement:

Scoping: defining the scope, objectives, rules of engagement and testing windows
Reconnaissance: gathering information and mapping the attack surface
Vulnerability identification: scanning and in-depth manual analysis
Exploitation: controlled demonstration of the real impact of flaws
Post-exploitation: assessing the reach (data access, escalation, persistence)
Report: prioritised findings (CVSS), evidence, and remediation recommendations
Re-test: verifying the effective correction of critical flaws

Pentest for SMBs, startups and SaaS

SMBs and SaaS vendors are prime targets: exposed attack surface, sensitive client data, and growing contractual requirements. More and more enterprise clients require a recent pentest before signing.

We adapt the scope and effort to your context and budget, focusing on what really matters: the data and functions critical to your business. For a SaaS, data isolation between clients (multi-tenant) receives particular attention.

My support

Beyond the report, I support you in prioritising and fixing the flaws, and can re-test to confirm remediation. As an outsourced CISO, I can also embed audit and pentest in a continuous security approach rather than a one-off exercise.

Cybersecurity audit & penetration testing (pentest)