We break in.
Before they do.
CyprusPentest is a Limassol-based offensive security team. We test the way real attackers work — across web, API, cloud, network and AI systems — so Cyprus businesses find and fix critical weaknesses before they become a breach or a GDPR fine.
penetration testing services in cyprus
Every engagement is hands-on and exploit-driven: real attacks, reproducible proof and fixes your team can action — delivered by testers based in Cyprus, not an outsourced scan.
Web Application Penetration Testing
Web application penetration testing in Cyprus. Manual, exploit-led testing for Limassol & island-wide businesses — OWASP-aligned, GDPR &…
- Broken access control & IDOR
- SQL, NoSQL & command injection
- Authentication & session management flaws
API Penetration Testing
API penetration testing in Cyprus for REST & GraphQL. OWASP API Top 10, BOLA/BFLA and token testing for…
- Broken object-level authorization (BOLA)
- Broken function-level authorization (BFLA)
- Mass assignment & excessive data exposure
Mobile Application Penetration Testing
Mobile app penetration testing in Cyprus (iOS & Android). Static + dynamic analysis and backend API testing for…
- Hardcoded secrets, keys & token extraction
- Insecure local & keychain storage
- Certificate-pinning & root/jailbreak bypass
GraphQL Security Testing
GraphQL security testing in Cyprus — introspection, resolver authorization and query-depth abuse for Limassol SaaS & fintech APIs.
- Introspection & schema disclosure
- Per-resolver authorization (IDOR) gaps
- Alias/batching rate-limit bypass
Secure Code Review
Secure code review in Cyprus. Manual source audit plus SAST for Limassol software teams — find vulnerabilities at…
- Taint & data-flow analysis
- Injection and unsafe deserialization
- Authentication & authorization logic flaws
OWASP Top 10 Penetration Testing
OWASP Top 10 penetration testing for Limassol and island-wide businesses — manual, exploit-led assessment against every OWASP risk…
- Broken access control (OWASP A01)
- Cryptographic failures (A02)
- Injection: SQL, NoSQL, command, LDAP (A03)
E-Commerce Penetration Testing
E-commerce penetration testing for Limassol and island-wide businesses — payment, cart and checkout logic tested by hand. PCI…
- Payment and checkout flow abuse
- Price and quantity manipulation
- Coupon, discount and loyalty-point abuse
SaaS Penetration Testing
SaaS penetration testing for Limassol and island-wide businesses — multi-tenant isolation, RBAC and API security tested by hand.
- Tenant isolation and cross-tenant access
- Role-based access control (RBAC) enforcement
- Cross-tenant IDOR and data leakage
WordPress & CMS Penetration Testing
WordPress & CMS penetration testing for Limassol and island-wide businesses — core, plugins, themes and config tested for…
- Core, plugin and theme vulnerabilities (known CVEs)
- Authentication, brute-force and user enumeration
- File upload and remote code execution
Single-Page Application (SPA) Penetration Testing
SPA penetration testing for Limassol and island-wide businesses — React, Angular and Vue apps tested for client-side and…
- Client-side access control and hidden functionality
- Token storage and JWT handling
- DOM-based XSS and client-side injection
PCI DSS Penetration Testing
PCI DSS penetration testing for Limassol and island-wide businesses — CDE, segmentation and application testing aligned to PCI…
- Cardholder data environment (CDE) scoping
- Network segmentation control testing (11.4.5)
- External penetration testing of the CDE perimeter
SQL Injection Testing
SQL injection testing for Limassol and island-wide businesses — manual detection and safe exploitation of SQLi across every…
- Error-based and UNION-based SQL injection
- Blind SQLi (boolean and time-based)
- Second-order and stored SQL injection
Cross-Site Scripting (XSS) Testing
Cross-site scripting (XSS) testing for Limassol and island-wide businesses — reflected, stored and DOM-based XSS found and proven…
- Reflected XSS across every input and context
- Stored/persistent XSS in saved content
- DOM-based XSS in client-side JavaScript
Broken Access Control & IDOR Testing
Broken access control & IDOR testing for Limassol and island-wide businesses — the number-one web risk, tested across…
- Horizontal access control (cross-user IDOR)
- Vertical access control (privilege escalation)
- Object-level authorization on every reference
SSRF Testing
SSRF testing for Limassol and island-wide businesses — server-side request forgery hunted across every server-initiated request, including cloud…
- Basic and blind server-side request forgery
- Cloud metadata access (169.254.169.254)
- Internal service and port discovery via SSRF
Thick Client Application Penetration Testing
Thick client & desktop application penetration testing for Limassol and island-wide businesses — binaries, local storage, IPC and…
- Binary and reverse-engineering analysis
- Local data storage and configuration security
- Traffic interception and TLS validation
iGaming & Online Casino Penetration Testing
iGaming and online casino penetration testing for Cyprus-licensed operators — manual security testing of betting platforms, player data…
- Betting / casino platform & wallet penetration testing
- Account takeover & session-security testing
- Bonus, promotion & loyalty-point abuse testing
External Network Penetration Testing
External network penetration testing in Cyprus. We test your internet-facing perimeter for Limassol & island-wide businesses — validated,…
- Attack-surface & service enumeration
- Exposed admin panels & default credentials
- Exploitable service vulnerabilities
Internal Network Penetration Testing
Internal network penetration testing in Cyprus. Assumed-breach testing of lateral movement & segmentation for Limassol offices and data…
- Lateral movement & privilege escalation
- Credential harvesting & reuse attacks
- Network segmentation validation
Wireless Network Penetration Testing
Wireless (Wi-Fi) penetration testing in Cyprus. On-site WPA2/WPA3, rogue-AP and segmentation testing for Limassol offices, hotels and retail.
- WPA2/WPA3 authentication attacks
- Rogue AP & evil-twin susceptibility
- Client isolation & de-authentication
Firewall & Configuration Review
Firewall and configuration review in Cyprus. CIS-benchmark rule-base audit and hardening for Limassol businesses — shrink your attack…
- Firewall rule-base & any-any audit
- Network segmentation & zoning review
- CIS benchmark configuration gaps
IoT Device Penetration Testing
IoT & embedded device penetration testing in Cyprus. Firmware, hardware and cloud testing for Cyprus product makers and…
- Firmware extraction & analysis
- Hardware interfaces (UART/JTAG/SPI)
- Wireless protocol attacks (BLE/Zigbee)
OT / ICS / SCADA Penetration Testing
OT, ICS and SCADA penetration testing — safely assess PLCs, HMIs and industrial networks, validate IT/OT segmentation and…
- IT/OT segmentation & Purdue-zone validation
- Exposed HMI, SCADA & engineering-station review
- PLC/RTU configuration & default-credential testing
Maritime & Shipping Company Penetration Testing
Maritime and shipping company penetration testing — IMO 2021-aligned cyber risk testing for ship management, shore-side IT and…
- Shore-side fleet & crewing system penetration testing
- Ship-to-shore connectivity (VSAT / cellular) security review
- Business email compromise & finance-team phishing simulation
AWS Penetration Testing
AWS penetration testing in Cyprus. IAM privilege paths, S3 exposure and misconfiguration review for Limassol cloud-native businesses.
- IAM privilege escalation paths
- S3 and storage exposure
- SSRF-to-instance-metadata (IMDS) abuse
Azure Penetration Testing
Azure & Entra ID penetration testing in Cyprus. Identity attack-path and misconfiguration review for Microsoft-based Limassol firms.
- Entra ID role & consent abuse
- Managed identity & service principal attacks
- Subscription privilege escalation
GCP Penetration Testing
GCP penetration testing in Cyprus. Service-account abuse and IAM privilege-escalation review for Cyprus businesses on Google Cloud.
- Service account impersonation & key abuse
- IAM privilege escalation paths
- Cloud Storage bucket exposure
Kubernetes Penetration Testing
Kubernetes penetration testing in Cyprus. Container escape, RBAC and cluster-takeover testing for cloud-native Limassol businesses.
- Container escape & privileged pods
- RBAC & service-account misconfiguration
- Exposed API server, etcd & kubelet
Cloud Configuration Review
Cloud configuration review in Cyprus across AWS, Azure & GCP. CIS-benchmark posture audit and remediation roadmap for Cyprus…
- CIS benchmark configuration gaps
- IAM hygiene & over-privileged access
- Public exposure of storage & services
Container Security Assessment
Container & Docker security assessment in Cyprus. Image, registry and supply-chain review for Cyprus DevOps and product teams.
- Image layer & dependency analysis
- Secrets in build args & layers
- Registry exposure & access control
Red Team Operations
Red team operations in Cyprus. Stealthy, objective-driven attack simulation testing detection & response for mature Limassol organisations.
- Objective-based full kill-chain attack
- Initial access via phishing & exposure
- Command-and-control & evasion
Social Engineering Assessment
Social engineering assessment in Cyprus. Authorised phishing, vishing and pretext testing of your people for Limassol businesses.
- Targeted spear-phishing campaigns
- Vishing (voice) pretext calls
- Payload delivery & credential capture
Phishing Simulation
Phishing simulation in Cyprus. Realistic, authorised email campaigns measuring click and reporting rates for Limassol businesses.
- Tailored phishing lure design
- Click and credential-entry tracking
- Reporting-rate measurement
Physical Penetration Testing
Physical penetration testing in Cyprus. Tailgating, badge cloning and on-site access testing for Limassol offices and facilities.
- Tailgating & social entry
- RFID/badge cloning & bypass
- Lock picking & door bypass
Assumed Breach Assessment
Assumed breach assessment in Cyprus. Start from a compromised foothold to measure blast radius and detection for Limassol…
- Post-compromise lateral movement
- Privilege escalation to critical systems
- Credential harvesting & reuse
Ransomware Readiness Assessment
Ransomware readiness assessment — attack-path simulation, backup and recovery validation, and detection testing against real ransomware TTPs.
- Initial-access & foothold simulation
- Privilege escalation & Active Directory attack paths
- Credential theft & lateral movement
Active Directory Penetration Testing
Active Directory penetration testing in Cyprus. Kerberos, delegation and path-to-domain-admin testing for Limassol enterprises.
- Kerberoasting & AS-REP roasting
- Unconstrained & constrained delegation abuse
- ACL and object-permission escalation
Entra ID (Azure AD) Security Assessment
Entra ID / Azure AD security assessment in Cyprus. Role, consent and conditional-access review for Microsoft-based Limassol firms.
- Directory role & PIM configuration
- OAuth app consent & permission abuse
- Conditional access policy gaps
OAuth, OIDC & SAML SSO Security Testing
SSO security testing in Cyprus for OAuth, OIDC & SAML. Redirect, token and assertion testing to prevent account…
- redirect_uri & state parameter abuse
- Authorization code & PKCE flaws
- JWT/id_token validation weaknesses
AI Agent Penetration Testing
AI agent penetration testing in Cyprus. Tool-abuse, goal-hijack and sandbox-escape testing for Cyprus companies deploying autonomous AI.
- Tool-use & function-calling abuse
- Goal hijacking & instruction override
- Privilege escalation through agent tools
Prompt Injection Testing
Prompt injection testing in Cyprus. Direct and indirect injection testing across every untrusted input for Cyprus AI products.
- Direct prompt injection
- Indirect injection via RAG & documents
- Tool-output & web-content injection
LLM Jailbreak & Guardrail Testing
LLM jailbreak and guardrail testing in Cyprus. Systematic safety-control and content-filter bypass testing for Cyprus AI products.
- Guardrail & content-filter bypass
- Policy evasion techniques
- Harmful-output elicitation
RAG Pipeline Security Assessment
RAG security assessment in Cyprus. Vector-store poisoning, leakage and access-control testing for Cyprus AI knowledge-base products.
- Vector-store & document poisoning
- Retrieval-based prompt injection
- Cross-tenant context leakage
MCP Server & Tool-Chain Security Testing
MCP server security testing in Cyprus. Tool-schema, confused-deputy and credential-scope testing for Cyprus AI tool-chains.
- MCP server & tool abuse
- Tool schema tampering & poisoning
- Confused-deputy & privilege paths
AI Supply Chain Security Audit
AI supply chain security audit in Cyprus. Model provenance, plugin and dataset-integrity review for Cyprus AI and ML…
- Model provenance & integrity
- Plugin & extension risk review
- Dataset integrity & poisoning exposure
LLM Application Penetration Testing
LLM application penetration testing in Cyprus. Full-stack testing of AI apps against the OWASP LLM Top 10 for…
- Prompt injection & output handling
- Insecure plugin & tool integration
- Sensitive information disclosure
Agentic AI Threat Modeling
Agentic AI threat modeling in Cyprus. Design-phase security analysis of autonomous AI workflows for Cyprus product teams.
- Agent workflow & data-flow mapping
- Trust boundary identification
- Abuse-case & threat enumeration
NIS2 & DORA Compliance Readiness
NIS2 and DORA compliance readiness — gap analysis, ICT risk assessment and the pentesting and TLPT these EU…
- NIS2 risk-management & reporting gap analysis
- DORA ICT-risk & operational-resilience assessment
- Threat-led penetration testing (TLPT / TIBER-EU) scoping
CySEC ICT Risk & Cybersecurity Compliance Penetration Testing
CySEC ICT risk compliance penetration testing for Cyprus Investment Firms — evidence Circular C571/C609 ICT and security risk…
- Trading platform & client portal penetration testing
- Back-office, CRM & KYC data exposure testing
- API, FIX protocol & third-party integration testing
DORA TLPT — Threat-Led Penetration Testing
DORA-aligned threat-led penetration testing (TLPT) for Cyprus financial entities — TIBER-EU-aligned scoping for significant entities, and resilience testing…
- DORA applicability & TLPT-scope determination
- Threat-intelligence-led attack scenario design (where TLPT applies)
- Red-team simulation against production-aligned systems
NIS2 Compliance Penetration Testing Cyprus
NIS2 penetration testing and compliance readiness for Cyprus essential and important entities — risk-management gap analysis, technical testing…
- Entity classification & Annex I/II scope determination
- Article 21 risk-management measures gap analysis
- External & internal network penetration testing
ISO 27001 Penetration Testing (Annex A.8.29)
ISO 27001 penetration testing mapped to Annex A.8.29 — the evidence certification auditors expect for security testing in…
- External & internal network penetration testing
- Web application & API penetration testing
- Cloud configuration & access-control review
Corporate Service Provider & Law Firm GDPR Penetration Testing
GDPR-focused penetration testing for Cyprus corporate service providers, fiduciary firms and law firms handling client, KYC and beneficial-ownership…
- Client & case management system penetration testing
- Document management & e-signature platform testing
- Email security & business email compromise exposure testing
MiCA & CASP Penetration Testing Cyprus
Penetration testing for Cyprus-licensed Crypto-Asset Service Providers under MiCA — technical evidence CySEC expects alongside your ICT risk…
- CASP trading / exchange platform penetration testing
- Custody & wallet infrastructure security testing
- Key management & hot/cold wallet separation review
EMI Penetration Testing Cyprus
Penetration testing for Cyprus-licensed Electronic Money Institutions — technical evidence for Central Bank of Cyprus ICT risk and…
- Payment platform & API penetration testing
- Account takeover & session security testing
- Safeguarding account / fund segregation control review
engagement flow
One clear methodology, from first recon to a free retest — aligned with OWASP, PTES and the standards Cyprus auditors expect.
Scope & Recon
Agree objectives and rules of engagement, then map your full attack surface across in-scope assets.
Exploit
Hands-on, chained exploitation that proves genuine business impact — never a list of theoretical findings.
Report
Clear reporting with reproducible proof, honest severity ratings and prioritised fixes for your developers.
Retest
A complimentary retest confirms every fix genuinely closes the attack path.
built for cyprus
From CySEC-regulated brokers and fintech in Limassol to shipping, iGaming and SaaS companies — we understand the compliance drivers and threats Cyprus businesses face.
gdpr_and_nis2
Regulators and clients increasingly demand evidence of security testing. Our reports support GDPR, the EU NIS2 Directive and ISO 27001 assessments, with a formal attestation letter.
on_the_ground
We are based in Cyprus and work in your timezone, serving businesses in Limassol, Nicosia, Larnaca, Paphos and island-wide. Fixed-price scoping, fast turnaround and a named point of contact throughout — not an offshore ticket queue.
Book a penetration test in Cyprus
Ready to see your systems the way an attacker does? Scope a penetration test of your web app, infrastructure or cloud with a Cyprus-based team today.
Get in touch