Services

A Penetration Testing Company Built for Enterprise Assessments

Cyber Security Pentesting Inc. is a Toronto penetration testing company serving mid-market and regulated enterprises across Canada, with delivery to organizations in the United States as well. Every assessment is scoped, executed, and reported personally by Arturs Stay, a penetration tester holding OSCP and OSEP who earned the CREST Registered Penetration Tester qualification in 2023. There is no subcontracting, no offshore delivery, and no hand-off to a junior analyst with a scanner.

Scope at a glance: web application and API testing, external and internal network testing, multi-cloud assessment across AWS, Azure, and GCP, Active Directory and Entra ID attack paths, social engineering, red team operations, AI and LLM red teaming, compliance-driven testing for PCI DSS, SOC 2, ISO 27001, HIPAA, and PIPEDA, custom-scoped engagements, and sector programs for financial services and OSFI B-13.

Reports are written for two audiences: reproduction steps for your engineering team and a risk narrative your board and auditors can act on. Pick a service below, use the decision guide to match an assessment to your situation, read how we deliver penetration testing services across Toronto and Canada, or Book a scoping call and we will recommend the right scope.

Web Application Security

Manual, research-driven security assessments of web applications, REST and GraphQL APIs, microservices architectures, and third-party integrations. OWASP Top 10, business logic flaws, authentication weaknesses, OAuth/OIDC abuse, SSRF, deserialization, race conditions, and API-specific vulnerabilities, every finding proven with working exploit code.

OWASP Top 10APIs & GraphQLMicroservicesSSRFBusiness LogicOAuth Abuse

Network & Infrastructure Penetration Testing

EXTERNAL & PERIMETER, Internet-facing infrastructure, routers, firewalls, VPNs, and exposed services. OSINT recon, subdomain takeover, protocol attacks, chained exploitation, and authentication bypasses.

INTERNAL NETWORK, Assumed-breach and insider threat scenarios. Lateral movement, credential abuse, privilege escalation through misconfigurations, segmentation bypass, and persistence testing.

External PerimeterInternal NetworkOSINTLateral MovementSegmentation TestingProtocol AttacksPersistence

Multi-Cloud Security Assessment

Adversarial assessments of hybrid, on-premises, and multi-cloud environments across AWS, Azure, and GCP. IAM privilege escalation, misconfigured storage and compute, cross-cloud lateral movement, container and Kubernetes security, serverless function abuse, CI/CD pipeline attacks, and on-prem to cloud pivot paths, the full attack surface modern enterprises expose.

AWS / Azure / GCPHybrid & On-PremIAM EscalationK8s & ContainersCI/CD AttacksCross-Cloud Pivoting

Active Directory Attack

Complex single and multi-forest Active Directory and Entra ID (Azure AD) assessments using real attacker TTPs. Kerberoasting, AS-REP roasting, DCSync, BloodHound, DACL/ACL abuse, GPO manipulation, delegation abuse, inter-forest trust attacks, and hybrid identity exploitation, with Impacket, CrackMapExec, and custom tooling.

Multi-Forest ADEntra IDBloodHoundKerberoastingDCSyncTrust AttacksImpacket

Red Team Operations

Full-scope adversarial simulations aligned to MITRE ATT&CK, modelling real threat actor behaviour from initial access through lateral movement, privilege escalation, and data exfiltration. We test your people, processes, and technology simultaneously using custom C2 infrastructure, OPSEC-hardened tooling, and assumed breach scenarios, across physical, digital, and social attack vectors.

MITRE ATT&CKCustom C2OPSECAssumed BreachFull Kill-ChainPhysical + Digital

AI Red Teaming

Adversarial testing of AI/ML systems, LLM-integrated applications, and agentic AI workflows. Prompt injection, jailbreaking, model extraction, data poisoning, RAG pipeline manipulation, tool-call hijacking, supply chain attacks, and GenAI risks including data leakage and model inversion, aligned to the OWASP LLM Top 10.

LLM AttacksPrompt InjectionAgentic AIRAG PipelinesOWASP LLM Top 10GenAI Risks

Compliance-Driven Assessments

PCI-DSS, SOC 2 Type II, ISO 27001, HIPAA, PIPEDA, NIST CSF, and CIS Controls-aligned penetration testing and gap analysis. Includes audit-readiness assessments, technical findings for your security team, a prioritised remediation roadmap, and board-level reporting deliverables designed for audit committees and regulators.

PCI-DSSSOC 2ISO 27001HIPAAPIPEDA

Custom Tailored Pentest

Engagements scoped entirely around your objectives, environment, and risk priorities. You define the targets, depth, and success criteria, we build the methodology around them. Ideal for unique technology stacks, bespoke threat models, pre-acquisition due diligence, or scenarios that don't fit a standard engagement template.

Client-Defined ScopeBespoke MethodologyThreat ModellingDue DiligenceCustom Objectives

Financial Services Penetration Testing

Sector-specific testing for Canadian banks, credit unions, OSC-registered firms, CIRO dealers, OSFI-supervised institutions, and fintechs. Identity-first (Active Directory and hybrid AD plus Entra ID), payment and open-banking API surfaces, segmentation around core banking, and third-party risk. Reports framed against OSFI B-13, OSC, CIRO, PCI DSS, SOC 2, and PIPEDA. Data stays in Canada.

Banks & Credit UnionsOSC / CIROOSFIPayment / APIFintech

OSFI B-13 Penetration Testing

Independent, threat-led penetration testing that supports OSFI Guideline B-13 (Technology and Cyber Risk Management, effective 1 January 2024) for federally regulated financial institutions. Findings mapped to the three B-13 domains, governance and risk management, technology operations, and cyber security, so risk and compliance teams can place them straight into their B-13 self-assessment. Testing supports B-13 alignment; OSFI determines compliance.

OSFI B-13FRFIThreat-LedCyber ResilienceCanada-Resident

Request a Service Engagement →

Which assessment do you need?

›Your customer-facing app or API handles sensitive data: web application penetration testing.
›You need to know what an attacker can reach from the internet or from inside your office network: network and infrastructure penetration testing.
›Your workloads run in AWS, Azure, or GCP and the IAM and configuration layer has never been tested: multi-cloud security assessment.
›You run Active Directory or Entra ID and want to know how fast a foothold becomes Domain Admin: Active Directory attack assessment.
›Your auditor, customer, or regulator is asking for a penetration test report: compliance-driven assessments.
›Your security program is mature and you want detection and response tested end to end: red team operations.
›You are shipping LLM features or AI agents into production: AI red teaming.

How to evaluate a penetration testing company

›Verifiable credentials. Ask for the tester's CREST registration and certifications, not the firm's marketing. Ours are listed and verifiable on the certifications page.
›Who actually runs the engagement. Confirm the consultant on the sales call is the one doing the testing. Every Cyber Security Pentesting engagement is led by the principal consultant, as set out on why organizations trust Cyber Security Pentesting.
›Manual, exploit-proven findings. Ask how findings are validated. We demonstrate critical findings with proof-of-concept exploitation rather than reporting scanner output.
›Rules of engagement before testing starts. Expect written targets, out-of-scope and fragile systems, timelines, and emergency stop procedures. Ours are defined in the scoping phase of our engagement process.
›Report structure. Ask for a sample outline. Cyber Security Pentesting delivers a technical report with reproduction steps and remediation guidance, an executive summary for leadership and the board, and a live debrief call.
›Retest terms stated up front. Know before you sign whether retesting is included. At Cyber Security Pentesting, retesting and remediation validation can be part of the engagement or arranged separately, with scope, timing and terms set in your approved proposal.
›Where your data lives. Ask where engagement data and reports are stored. Cyber Security Pentesting is Canada-based, and financial services and OSFI B-13 engagements keep data in Canada.
›Independent proof. Read published client reviews and recommendations rather than anonymous logos. Ours are linked from why organizations trust Cyber Security Pentesting.

RELATED RESOURCES

Get Started

From the Blog

What We Test

Attack Paths We Test Across Canadian Enterprise Environments

High-impact attack paths we pursue across Active Directory, cloud and web application engagements.

DCSync

Non-DC accounts holding DCSync privileges in enterprise Active Directory.

IAM

IAM privilege escalation to cloud administrator.

Logic

Exploitable business logic flaws missed by automated DAST.

Tier 0

Active Directory attack paths tested from internal foothold toward Domain Admin, including Kerberoasting, DCSync, BloodHound path analysis, ADCS abuse, and delegation chains.

Frequently asked questions

How is the scope of a penetration test defined?

Scope is agreed on a scoping call before any proposal is issued. We confirm the applications, cloud accounts, network ranges, or identity systems to be tested, the access level, the testing window, and any compliance driver. The proposal then states that exact boundary, the methodology, and the price for it.

How long does a penetration test take?

Duration follows the size and complexity of the agreed scope rather than a fixed calendar. A single application or external perimeter is shorter than a red team operation or a multi-environment program, which run in planned phases. The timeline is written into the proposal so your testing window and audit dates are protected.

What do we receive at the end of the engagement?

You receive a full technical report with reproduction steps, and remediation guidance for every finding, an executive summary that frames business risk for leadership and auditors, and a live debrief call that walks your team through the results. Post-report remediation support, such as review calls and follow-up questions, is defined in the approved engagement proposal.

Is a retest included after we fix the findings?

Retesting and remediation validation can be included in the engagement or arranged separately; the scope, timing and terms are set in your approved proposal. A retest verifies that each finding has been correctly resolved and that the same or similar attack paths are no longer viable, which is the evidence auditors and customers typically ask to see.

Do you deliver penetration testing outside Toronto, including in the United States?

Yes. Cyber Security Pentesting Inc. is based in Toronto and serves enterprises across Canada first, with clients in the United States as well. On-site work, including physical and internal testing, is arranged across Toronto and the Greater Toronto Area when the scope requires it.

Not sure which assessment fits?

Tell us what you need to protect and who is asking for the test. We will recommend a scope and send a proposal.

Book a scoping call