Skip to content
Edictum Labs, home
Discipline 02

Penetration
testing

Authorized assessment for organizations that need serious technical investigation — not an automated scan with a logo on the cover.

Scope an assessment
Basis
Authorized · consent-based
Output
Demonstrated, not asserted
Based in
Prague
The difference

Assessment with the depth of research behind it.

A scanner tells you what is already known. We tell you what is actually true about your system.

Automated tooling has its place, and we use it. But the findings that decide a breach are usually logic flaws, broken authorization, and chained weaknesses that no scanner reaches — because they require understanding what the system is trying to do, and where that intent breaks down.

Every engagement is driven by the same investigative method we bring to vulnerability research, scoped to your environment and your risk.

Scope

What we assess.

Engagements are shaped around your systems and the questions that actually keep you up at night.
  • Web applications and APIs
  • Cloud and infrastructure
  • Kubernetes and container platforms
  • AI agents and LLM applications
  • Authentication and authorization systems
  • Security-critical software
Cloud & infrastructure in depthAI systems in depth
Engagement

How an assessment runs.

01

Scope and authorization

We agree exactly what is in scope, what is off-limits, and who approves it — in writing. No testing begins without explicit, documented authorization.
02

Investigation

We map the real system before attacking it: its surfaces, trust boundaries, identities, and the assumptions it depends on. Understanding precedes exploitation.
03

Exploitation and validation

Candidate issues are proven, not asserted. We establish real impact and the precise conditions required, without causing avoidable disruption to your systems.
04

Reporting

Each finding arrives with root cause, reproduction, business impact, and a remediation path — prioritised so your team knows what to fix first and why.
05

Remediation validation

After you have fixed the issues, we verify the fixes actually close them — including the variants a narrow patch tends to miss.
Deliverables

A report you can act on, not file away.

Clear enough for leadership to weigh the risk, precise enough for engineering to close it.
  • Prioritised findings with real, demonstrated impact
  • Reproducible evidence for every issue
  • Clear remediation guidance per finding
  • An executive summary that reflects reality
  • A technical readout your engineers can act on
  • Retest and remediation validation
Rules of engagement

Serious testing is bounded testing.

Authorized, scoped, and documented — every time.

We test only what we are explicitly authorized to test, within agreed boundaries, under a signed engagement. We work to avoid disruption, handle any data we encounter with care, and report critical findings immediately rather than waiting for the final document.

Engagements

Need an assessment that actually tests?

Tell us what you are shipping and what you are worried about. We will scope an engagement that investigates it properly — and tell you if a lighter approach would serve you better.

Reply
Within two business days
Authorization
Written, before any testing
Based in
Prague, Czech Republic