Penetration testing for public sector software suppliers

Testing application security for public sector services

We test how your system uses its integrations — KYC, payment, bank and eID services.

Tenders, contract clauses and reporting

A tender or a security clause in a public contract may prompt a contracting authority to ask for a test of the service you supply.

The report is evidence you can give your auditors, supervisors and customers. What they accept is their decision.

Our reports include an executive summary, the scope of work, the test type and methods, the methodology, how risk is calculated, a summary of findings, detailed results for each finding, and a conclusion.

We deliver the report in the language you ask for: English, Estonian or another language, or more than one.

You can request our sample web application penetration test report through the contact form or by email.

Application risks in EdTech platforms

If your company supplies a learning management system or assessment platform to schools, universities or education ministries, a ministry pilot or a procurement pack may ask for a penetration test.

We test your web learning management system (LMS), proctoring modules within your web platform, mobile apps and platform APIs.

Learning and assessment checks

• SSO: whether switching accounts at sign-in leaves your platform applying the previous account’s permissions
• LTI launches: whether your platform lets a student initiate a launch with a teacher role
• OneRoster sync: whether your platform continues to allow course access after the sync has withdrawn it
• Tenant isolation: whether your platform lets an administrator for one institution change assessment settings in another institution’s space
• Exam integrity: whether your platform enforces attempt limits on the server when a candidate resends or alters a submission request

When planning your academic year, schedule the test before important business events or launches, such as a pilot go-live or the release of a new assessment feature. See how a test is planned and scheduled.

From the customer’s request to testing

1. Set the boundaries of this test
   Every test starts with planning: we agree the scope, the systems to test and the rules that avoid disruption.
   
   We scope each test with you, either through our scoping questionnaire or in a scoping meeting where we ask the same questions.
   
   For the service named in your customer’s request, we agree one approach at scoping: black-box, grey-box or white-box.
2. Where the service will be tested
   We test on live systems and on staging environments. Roughly 70% of our tests run on live systems and 30% on staging.
3. Plan for live service availability
   For a live citizen-facing service, make availability part of the planning conversation.
   
   Testing is conducted under controlled conditions with agreed rules of engagement. We schedule around your business needs.
4. Allow for the testing period
   Testing takes from a few days to a few weeks, depending on the project. The average testing period is 1–2 weeks.
5. Check the available start
   When testing can start depends on our current schedule. If you need it sooner, contact us and we will do our best to accommodate you.

Report and retest

Every report lists the vulnerabilities found, rates each by risk, and gives remediation steps. A penetration test report also sets out the exploitation methods demonstrated during testing, and a priority-based action plan.

Within a report of 20–100+ pages, any findings are rated individually by severity.

After you fix the findings, we re-test them.

A retest covers the findings only, not the full application. It is usually quoted in the same offer as the test. The retest window is about 4 weeks, or sooner if you have fixed the findings earlier and our schedule has an opening.

Experience and method

With over 7 years of experience in testing, we have built extensive expertise in web applications and websites, e-commerce platforms, mobile applications, APIs and SaaS solutions.

Our penetration tests can follow OWASP, ISSAF, PTES or OSSTMM at your request or on our recommendation. What we follow and how much of it we cover are agreed at scoping.

Testing uses Burp Suite, manual testing and our own tools.

Our pentesters hold certificates including PNPT, eCPPTv2, CAP, CompTIA PenTest+ and CompTIA Security+, and their published research includes five CVEs.

Questions

Does NIS2 require a penetration test?

If your public-sector customer is covered by NIS2, this is what NIS2 says about requiring a penetration test:

In the EU, NIS2 Article 21(2)(f) requires the cybersecurity risk-management measures of essential and important entities to include policies and procedures to assess their effectiveness. NIS2 does not require a penetration test by name. A test is one way to provide that evidence.

Our public-sector customer or contracting authority wants the report. What will they receive?

The report is evidence you can give your auditors, supervisors and customers. What they accept is their decision.

Every report lists the vulnerabilities found, rates each by risk, and gives remediation steps. A penetration test report also sets out the exploitation methods demonstrated during testing, and a priority-based action plan.

Do you test SSO, OIDC and eID sign-in paths?

SSO, OIDC and eID sign-in paths are within the scope of testing your public digital service.

For example, a sign-in check can examine whether the citizen portal accepts an expired token.

What does a test of a public digital service cover?

Testing a public digital service can follow the path from identity sign-in through a citizen portal to form submission and the API requests behind it, with checks for personal-data exposure.

For example, we check whether a form error reveals personal details that the account is not authorised to see.

Which parts of our EdTech platform do you test?

A penetration test of an EdTech platform covers the web LMS, proctoring modules within the web platform, mobile apps and platform APIs. The test examines how your platform uses SSO, LTI and OneRoster integrations, alongside tenant isolation and logic flaws affecting exam integrity.

For example, we check whether your platform allows an exam to start before a required proctoring step within the web platform is complete.

Which languages can we request for the test report?

We deliver the report in the language you ask for: English, Estonian or another language, or more than one.

Will testing disrupt people using our live citizen-facing service?

Testing is conducted under controlled conditions with agreed rules of engagement. We schedule around your business needs.

Describe any operating-hour constraints for the citizen-facing service when we plan the test.

How will you price a test of the service we supply to a public body?

The number of systems or applications in scope, the testing type, the complexity of the environment and the timeline determine the price of testing the service you supply.

Read the common questions about testing costs and planning alongside your public-sector customer’s request.

Does a vulnerability assessment also try to exploit weaknesses?

A vulnerability assessment scans your systems with Burp Suite, and an expert verifies and prioritises what the scan finds. A penetration test goes further: testers try to exploit what they find and show you the impact.

Choose between penetration testing and vulnerability assessment for the public digital service you supply.

Does GDPR require a penetration test?

Among the security measures GDPR Article 32(1) expects controllers and processors to implement where appropriate is a process for regularly testing, assessing and evaluating their effectiveness (point (d); the UK GDPR has the same text). A penetration test is one way to evidence that process for the systems it covers.

Related services

• Web application security testing
• Mobile application security testing
• API security testing
• Penetration testing
• Vulnerability assessment