A penetration test shows how far an attacker would get into your systems — before anyone actually tries. Unlike an automated vulnerability scan, a pentest combines tools with manual analysis: vulnerabilities found are verified, linked together and assessed in terms of their real-world impact.
Wingsecurity carries out penetration tests for companies in Basel and across Switzerland, remotely or on site. As a security company with both physical and digital expertise, we also consider attack paths that go beyond pure IT — such as unprotected network sockets in publicly accessible rooms.
The penetration tests we carry out
The scope depends on your systems and your risk. Typical test targets include:
- Web applications and APIs: authentication, authorisation, input handling, session handling and business logic
- External infrastructure: servers reachable from the internet, VPN access, email and remote services
- Internal network: what can an attacker reach who has already compromised a workstation?
- Wi-Fi and network segmentation: separation of guest, office and production networks
- Social engineering and phishing simulations, by prior arrangement with senior management
The process: from scoping to retest
Every penetration test begins with a scoping meeting. Together, we define which systems will be tested, which are excluded, in which time window testing takes place, what testing depth is required (black, grey or white box) and how to proceed in the event of a critical finding or a disruption. These points are agreed in writing.
Without the express permission of those authorised, gaining access to other parties’ secured systems would be a criminal offence in Switzerland (Art. 143bis Swiss Criminal Code). That is why we also clarify in advance whether third parties such as hosting or cloud providers need to give their consent or be informed.
During the test, we follow recognised methodologies, such as the OWASP Web Security Testing Guide for web applications. Once the vulnerabilities have been fixed, we carry out a retest to check that the measures are effective.
The report: prioritised and easy to understand
At the end, you receive a report in two parts: a management summary explains the risks and the need for action in plain language. The technical part describes each vulnerability with evidence, rating, affected systems and specific recommendations for remediation. We go through the results with your team in a meeting.
We treat reports, credentials and project documents in strict confidence; test accounts and temporary access should be deactivated once the project is complete.
Why test regularly?
The Federal Act on Data Protection requires companies that process personal data to ensure data security appropriate to the risk (Art. 8 FADP). If a data security breach nevertheless occurs that is likely to result in a high risk for the data subjects, it must be reported to the FDPIC (Art. 24 FADP; see the FDPIC guidelines on data breaches).
A penetration test is one of several measures for checking the effectiveness of your safeguards. It makes sense before new applications go live, after major changes to infrastructure or software, and at regular intervals. We also offer security audits and incident response.