PRT (Primary Refresh Token): How it Works and Exploitation Techniques
With the widespread adoption of hybrid environments and the Zero Trust model, Microsoft Entra ID (formerly Azure AD) has established itself as a centr...
A penetration test involves replicating the actions of an attacker in order to assess the real level of security of an information system (web and mobile applications, infrastructure, networks, APIs, IoT devices, cloud environments, etc.) or users through social engineering scenarios.
The objective is twofold: to identify exploitable vulnerabilities and configuration errors that could compromise the confidentiality, integrity or availability of data, and to provide concrete, prioritised recommendations to remediate these vulnerabilities and reduce the attack surface over time.
A penetration test is not limited to an automated scan. We take a pragmatic, risk-based approach to replicate realistic attack scenarios and assess the real impact of your vulnerabilities.
Each penetration test begins with a scoping phase to define the scope of the assessment, the level of information provided (black box, grey box or white box), and the threat scenarios most relevant to your business. The goal is to ensure testing aligns with your business and regulatory requirements.
Our experts combine manual testing with specialised tools to identify exploitable technical vulnerabilities, business logic flaws and misconfigurations. We then validate their impact within a controlled environment to assess the risks to the confidentiality, integrity and availability of your systems.
Each engagement results in a clear and prioritised report including proof-of-concept evidence and actionable technical recommendations. We can also perform post-remediation validation to ensure that vulnerabilities have been effectively remediated.
We perform penetration tests tailored to each attack surface: applications, infrastructures, cloud environments and the human factor. Every engagement is based on realistic attack scenarios aligned with your business priorities and risk level.
We conduct penetration tests on both simple architectures and complex environments. Our expertise covers all technical layers of an information system.
Our teams regularly assess:
This cross-disciplinary expertise enables us to identify technical vulnerabilities, architectural weaknesses and business logic flaws often missed by standardised approaches.
A penetration test can be conducted with different levels of information shared with our auditors: black box, grey box or white box. The chosen approach depends on your objectives, your security maturity and the threat scenario you want to assess.
Simulation of an external attack without prior information. This approach assesses your actual exposure to an attacker with no internal access or documentation.
Our auditors are provided with partial information (user accounts, limited documentation, architectural details). This approach replicates a scenario in which an attacker has already gained initial access or has access to internal information.
Assessment conducted with full access to technical elements (source code, architecture diagrams, privileged accounts). This approach enables an in-depth analysis of application security and the robustness of internal controls.
Defining the scope is a critical step to ensure the relevance and effectiveness of a penetration test.
Penetration testing is a tailored approach that must align with your objectives: assessing your internet-facing attack surface, testing the resilience of an internal network, auditing a critical application or validating the effectiveness of remediation measures.
The selection of targeted assets directly influences the depth of the analysis and the operational value of the results. To go further, our white paper helps you define a relevant scope by aligning your business priorities with a coherent and effective offensive security strategy.
Our methodology is based on a structured, attack-scenario-driven approach designed to replicate real-world compromise conditions.
We collect and analyse publicly available information (OSINT) to identify exposed assets such as IP addresses, subdomains, technologies in use, accessible services, code repositories and cloud exposures. This phase enables us to accurately map the attack surface and define relevant attack scenarios.
Our auditors combine specialised tools with in-depth manual analysis to identify technical vulnerabilities and business logic flaws resulting from misconfigurations, implementation weaknesses or architectural issues.
Each vulnerability is exploited in a controlled manner to confirm its exploitability and assess its real impact, such as unauthorised access, privilege escalation, lateral movement or the compromise of sensitive data.
At the end of the engagement, we deliver a structured report including:
A debriefing session is also organised to present the findings and support your teams in the remediation process.
This executive summary presents the results of a penetration test in a format accessible to non-technical audiences. It highlights the key risks, the overall level of exposure and the priority actions, facilitating discussions with senior management, investors or during tender processes.
Following a penetration test, Vaadata can issue a security seal confirming that an independent security assessment has been performed on a defined scope. This helps demonstrate a proactive cybersecurity approach while clearly indicating the scope and date of the assessment.
Issued after remediation validation, this certificate confirms that an in-depth application penetration test has been conducted by an independent trusted third party and that the identified vulnerabilities have been remediated. It serves as tangible evidence in the context of compliance, audits or contractual processes.
Choosing Vaadata for your penetration testing means relying on a company specialised in offensive security, combining advanced technical expertise, a proven methodology and international standards.
We are CREST certified, an international accreditation issued by a leading independent body in cybersecurity. This certification demonstrates the rigour of our processes, the maturity of our methodology and the high level of expertise of our security auditors.
Vaadata is also certified ISO 27001 (information security management) and ISO 27701 (privacy and data protection). These standards ensure an organisational and technical framework aligned with the highest requirements for confidentiality and risk management.
Our certifications, as well as those held by our auditors, reflect our commitment to delivering rigorous, realistic and impact-driven penetration tests to sustainably strengthen your security posture.
