01
Authorization before access
We do not test without a named owner, a written scope, and rules of engagement. If it is not in scope, it is out.
Penetration testing services · Doha & Marseille
Penetration testing that tells you what to fix first.
Find what is exposed. Leave with what to fix. ZeroFlare tests the systems you authorize, documents what we can prove, and reports it so engineers and leadership can act on the same facts.
- Written scope and rules of engagement
- Findings ranked by impact, with evidence
- A retest after you ship the fixes
Doha, Qatar · Marseille, France
Services
Testing shaped around the systems you actually run.
Start with one assessment or combine them. Every engagement begins from scope, not from a generic scan.
01
Web Application Penetration Testing
Authorized testing of the web applications your customers, staff, and partners rely on.
Learn more02
API Penetration Testing
Authorized testing of the APIs your applications, partners, and automations call.
Learn more03
Network Penetration Testing
Authorized testing of exposed services, remote access, and the paths between networks you believe are separate.
Learn more04
Cloud Security Assessment
A review of how your cloud accounts are actually configured, and which of those choices an attacker could use.
Learn more05
Mobile App Penetration Testing
Authorized testing of iOS and Android applications and the services they talk to.
Learn more06
Red Team Assessment
An authorized adversary exercise, including social engineering only when the targets and the pretext are agreed in writing.
Learn more07
Vulnerability Assessment
A broader look at known weaknesses, and a clear mapping to the control framework you actually use.
Learn moreWhy ZeroFlare
A calm practice for a noisy problem.
02
Judgment where tooling stops
Scanners cover ground. The issues that matter are usually access control, trust between systems, and paths an automated check will not reason about.
03
One report, two readers
Engineers get reproduction detail and remediation guidance. Leaders get a clear picture of impact, priority, and what will remain after the fixes.
04
The retest is part of the work
A finding is not closed because a ticket moved. We retest the fixes you ship and say plainly what still stands.
Engagement
Four stages, no mystery.
You always know what is in scope, what we are doing, and what comes back. The full method is on the methodology page.
Scoping
We agree the assets, the objectives, the window, and the rules. You know who to call if something unexpected appears.
Testing
We test inside that scope. Destructive checks and denial of service stay off unless you explicitly authorize them.
Reporting
You receive a prioritized report: what we found, why it matters, how we confirmed it, and what to do next.
Retest
After you remediate, we verify the fixes and update the record. Open items stay open until they are actually closed.
Where the work shows up
The same standard, different kinds of systems.
We do not publish a client list. These are the situations the services are built for.
Software companies
Customer-facing applications, the APIs behind them, and the accounts that administer both.
Operators
Networks, remote access, and the management paths that keep a service running.
Cloud teams
Identity, exposure, and logging in the accounts you actually use, not a generic benchmark.
Teams facing a review
A validated list of weaknesses, mapped to a control set you name, before a customer or auditor asks.
How an engagement is bought
Three ways to start. One way of working.
Single assessment
One system, one question, a written scope. The usual first engagement.
Combined test
An application and the cloud or network it sits on, scoped together so the findings connect.
Retest and follow-up
After you fix what a previous report named, we verify the fixes and update the record.
What comes back
A report you can hand to engineering and to leadership.
Every engagement produces the same kinds of documents. The methodology page describes them. None of them is a certificate.
- Rules of engagement and the scope you signed
- Technical findings with evidence and reproduction steps
- A short summary of impact and priority
- A retest note that says what is fixed and what is not
Questions
Before you book.
Will you test a system we do not own?
No. We need a named owner and written authorization. A request to test someone else's environment is not an engagement.
Do you run denial-of-service tests?
Not unless the rules of engagement allow it in writing, with the constraints next to the permission. The default is no.
Is a vulnerability scan a penetration test?
No. A scan is coverage of known issues. A penetration test is an attempt to reach an objective inside the scope. We sell them as different services.
How long does a first engagement take?
Once the scope is written, a focused assessment is often one to two weeks of testing plus reporting. A red team is longer. The service pages give the usual shape. The contract names the window.
Do you certify us against ISO or SOC 2?
No. If you want findings mapped to a framework, name it and we will map gaps. That mapping is not an audit opinion.