Cybersecurity & Penetration Testing Services

What is penetration testing (pentest)?

Penetration testing is an authorised, simulated attack that finds security holes before someone else exploits them. It is the most hands-on part of cybersecurity work: not a list of possible problems, but proof of which weaknesses can actually be broken into.

Unlike a vulnerability assessment, which relies on automated scanning, a pentest also verifies findings manually and shows their impact, for example customer data that can be opened without logging in.

Who needs a pentest?

Pentests matter most for websites and apps that store personal data, take payments, or have a login area for customers, partners or staff. The right moments are before launch, after major changes, or when corporate clients and partners ask for proof that your system has been security tested. The results also help your team decide which fixes come first, because every finding already carries a risk level.

What we test

• Web pentest. Websites and web apps: login and sessions, access control, form inputs, file uploads and server configuration, using the OWASP Top 10 risk categories such as injection and broken access control as a reference.
• API pentest. Endpoints used by mobile apps and partners: authentication, per-user authorisation, data validation and rate limiting.
• Mobile app pentest. Android and iOS apps and their communication with the server, including data stored on the device.
• Server hardening review. Open ports, software versions, security headers and server configuration.

Black box or grey box?

• Black box. The tester only gets the target address, like an outside attacker. Useful for seeing what is exposed to the public.
• Grey box. The tester gets accounts with specific roles, so they can check whether an ordinary user can open data or functions that belong to other users or admins. This approach reaches the parts of the app behind the login.

Testing and reporting process

• Scope and written authorisation. Targets, schedule and testing limits are agreed and approved in writing before testing starts.
• Testing. A combination of automated scanning and manual testing.
• Report. Every finding gets a risk level (critical, high, medium, low), evidence, impact and a recommended fix, plus a summary for management.
• Retest. After your team fixes the issues, we test again and update the report.

How much does a pentest cost?

Penetration testing starts from Rp15,000,000 per project. The final cost depends on the number of targets (website, API, Android app, iOS app), the number of pages, endpoints and user roles tested, and whether the approach is black box or grey box.

Fixing the vulnerabilities is not included in the pentest price. If needed, we can quote the fixes separately, or your own developers can work from the report.

Frequently asked questions

Will a pentest disrupt our live website?

Testing is designed not to damage data, and the schedule is agreed in advance. For sensitive systems, testing can run on a staging environment that mirrors production.

How often should we run a pentest?

At least before launch and after major changes, such as a new payment feature, a new API integration or a server move.

Can PopOut fix the vulnerabilities too?

Yes. As a website and app developer, we can fix the issues found, and routine care afterwards is available through our website maintenance service.

How long does a pentest take?

It depends on the number of targets and the testing approach. We share the schedule together with the quote.

Server security and your deployment process can also be tightened through our cloud and DevOps service. Send us the websites, APIs or apps you want tested through our contact page. Our other services are on the website and application development page.