How a MEIDAY penetration test works
The process has 7 steps: scope, written authorization, testing, report check, report delivery, fixing and a retest. We start only after we have agreed together on the scope of work and the rules of the test.
Seven steps
Define the test scope
You choose the type of system in the calculator and send an inquiry. We then verify the system details and define exactly what will be tested.
What you prepare: The system addresses, the user types, and any areas of the system you want left out of the test.
What we do: We confirm the scope of work and send a quote with the target list and a schedule. For complex systems we offer tailored pricing.
Authorize the test in writing
Before work starts, an agreement is signed and written authorization is received from an authorized party for every target in the test.
What you prepare: A signed agreement and proof of ownership or authorization. If an outside provider hosts the system, check whether their approval or coordination is needed.
What we do: We agree on the time window, test rate, prohibited actions and a contact who can ask us to stop the test.
Run the test
Autonomous AI-based tools test the system from the outside, within the agreed authorization, schedule and rules of engagement. The actions are designed to avoid deliberate harm to data or service availability.
What you prepare: Dedicated test accounts if the system has a login, and a contact who is reachable during the test.
What we do: We test the approved targets, record the relevant evidence, and stop if the named contact asks us to.
Check the report
Before delivering the report we go over it to check that everything looks right. In the base test the findings are not validated or reproduced one by one, and they appear in the report with the evidence the tools produced.
If you ordered the OSCP add-on, an OSCP-certified tester tries to reproduce each finding by hand, up to 10 per system, and records in the report whether it reproduced. This is a separate add-on, not a full manual test of the system.
Receive the report
The report contains an executive summary, the systems tested, the test method and its limitations, technical findings, evidence and recommended fixes. It also covers the parts that were not tested.
What you prepare: Decide who in your organization owns each finding, and pass the technical section to whoever maintains the system.
What we do: We deliver the report encrypted to the authorized contacts, through the channel you choose (email, WhatsApp or another), and answer follow-up questions.
Fix the findings
Your development team or system vendor deals with the findings, prioritized by severity and business context.
What you prepare: Record which findings were fixed, so we can focus on them in the retest.
Request a retest, at no charge
You can request one focused retest within 45 days of report delivery. It covers the reported findings, in the same scope only. New systems and features are not included.
What you prepare: Send a list of the fixed findings and make sure the test accounts are still active.
What we do: We retest the findings and update their status: fixed, not fixed, or inconclusive. For an inconclusive result we schedule one more attempt at no charge, subject to the terms set in the quote.
Frequently asked questions
What does the test cover?
The systems you authorized in writing, from the outside: the website or app, its public servers and its APIs, within the agreed scope. If there is a login, we also test what each user type can do. The exact list of systems goes in the quote before we start.
What is the difference between a pen test, a penetration test and a security assessment?
A pen test and a penetration test are two names for the same service. "Security assessment" is sometimes used for other kinds of testing too. Either way, the exact scope of work is spelled out in the quote.
Is the API counted separately?
No. The system’s APIs are included in the price when they are part of the agreed scope. A standalone API that is not part of a website or app counts as one system.
Do we need to install anything?
No. Testing is done from the outside. You do not need to install software or open an account with us. If the system requires login, we may ask for dedicated test accounts. The report goes to the contacts you name.
What if no vulnerabilities are found?
You get a report describing what was tested, how, and what was not tested. A report with no findings means no vulnerabilities were identified within the agreed scope and test method. It is no guarantee that the system is immune.
How long does it take?
It depends on the scope and the test window you approve. The schedule goes in the quote before we start, and we will not promise a date we cannot meet.
Is it safe for my system?
We do not take intentionally destructive actions, we work only in the agreed time window and we limit the test rate. Even so, any external test adds some load, so we agree on a contact who can stop it immediately if needed.
What language is the report in?
English. If you ask, we will write it in Hebrew.
Who checks the report before it is delivered?
MEIDAY goes over the report before delivery to check that everything looks right. Findings are validated one by one only with the add-on, by an OSCP-certified tester. The report check is not a manual penetration test.
What is the OSCP add-on?
An OSCP-certified penetration tester tries to reproduce the findings within the defined scope and documents the result. It is a separate paid service, per system, covering up to 10 findings. Beyond that, the price is set in the written quote.
What is a retest, and when is it free?
After you fix, we retest the reported findings in the same scope. The first retest is free if you request it within 45 days of report delivery. It does not cover new systems or features. A finding with an inconclusive result gets one more coordinated attempt, also free.
Does the report replace a test a regulator or auditor requires?
Not necessarily. If a regulator, auditor or customer requires a test in a specific format or by a tester with a specific certification, check the requirement with them before ordering. We will tell you whether our report fits.
Do you need our passwords?
For a public website, no. For an app with login we ask for dedicated test users for each user type, not your employees’ accounts. Do not send access details through the website form. We arrange a secure channel once the scope is agreed.
Want to know what it will cost?
Answer four short questions in the calculator and get a price estimate, including VAT.