Penetration Testing

Overview#

Internal security reviews catch a lot. They do not catch everything. A skilled external attacker approaches your platform with different assumptions, different tooling, and no institutional blind spots. That outside perspective is what structured penetration testing provides. For law enforcement agencies and defence organisations entrusting sensitive operational data to Argus, the assurance that independent experts have tried, hard, to break in matters as much as any certification.

Argus runs a formal penetration testing programme using qualified third-party security firms on a regular schedule. Every finding is tracked from discovery through remediation, verified by retesting, and fed back into the platform's development practices. Customers with enterprise agreements can request summaries of recent test activities under NDA.

Key Features#

• Regular Third-Party Testing: Independent security firms conduct penetration testing on a regular schedule, providing an unbiased assessment of the platform's security posture and identifying vulnerabilities that internal reviews may miss.

• Comprehensive Test Coverage: Testing spans the full breadth of the platform including network infrastructure, web applications, APIs, authentication systems, and authorisation controls to ensure no attack surface is overlooked.

• Structured Methodology: Tests follow industry-recognised methodologies encompassing reconnaissance, vulnerability identification, controlled validation, and detailed reporting with remediation recommendations.

• Vulnerability Lifecycle Management: Discovered vulnerabilities are tracked from identification through prioritisation, remediation, and verification retesting to confirm that fixes are effective.

• Attack Surface Monitoring: Continuous monitoring of the platform's exposed services and endpoints detects changes that could introduce new security risks, triggering additional assessment when needed.

• Compliance Validation: Security control testing validates effectiveness against industry standards and regulatory requirements, providing evidence for compliance audits.

• Remediation Tracking: Every finding is assigned to the appropriate team with severity-based SLAs, and progress is tracked through to verified resolution.

• Trend Analysis: Quarterly reporting includes trend analysis showing improvement over time across vulnerability categories, remediation speed, and overall security posture.

How It Works#

Testing Programme#

Argus maintains a structured penetration testing programme:

1. Scope Definition: Each engagement defines clear boundaries including target systems, permitted techniques, testing windows, and exclusions to ensure thorough coverage without operational disruption.

2. Security Assessment: Qualified testers evaluate the platform's defences through network, application, and infrastructure testing. Testing covers common vulnerability categories as well as platform-specific security concerns.

3. Findings and Reporting: Detailed reports document each finding with severity classification, potential impact, and specific remediation guidance. Executive summaries provide high-level risk assessments for stakeholders.

4. Remediation: Engineering teams address findings based on severity-driven priorities, with critical and high-severity issues receiving expedited attention.

5. Verification: Retesting confirms that remediation measures effectively address the identified vulnerabilities.

6. Continuous Improvement: Findings inform improvements to development practices, security controls, and monitoring capabilities, strengthening the platform's defences over time.

Testing Types#

The programme includes multiple testing approaches:

• External Assessment: Tests the platform's defences from an outside attacker's perspective
• Internal Assessment: Evaluates security controls from within the network boundary
• Application Security Testing: Focuses on web application and API vulnerabilities
• Red Team Exercises: Simulates advanced threat scenarios to test detection and response capabilities

Reporting and Transparency#

Customers can request summaries of recent penetration testing activities, including the scope of testing, overall findings summary (without exposing specific vulnerabilities), and remediation status. Detailed reports are available under NDA for enterprise customers.

Open Standards#

• CVE (Common Vulnerabilities and Exposures): All findings discovered during penetration testing are catalogued using CVE identifiers, enabling unambiguous cross-referencing with industry vulnerability databases and patch advisories.
• CVSS (Common Vulnerability Scoring System) v3.1: Vulnerability severity is scored using CVSS so that remediation prioritisation and SLA assignment are consistent with industry-standard risk ratings rather than subjective assessments.
• MITRE ATT&CK: Red team exercises and threat scenario planning map adversary techniques to MITRE ATT&CK tactic and technique identifiers, providing a common language for describing attacker behaviour across assessments.
• CWE (Common Weakness Enumeration): Findings are classified by CWE identifier where applicable, linking discovered vulnerabilities to their underlying software weakness categories to inform developer training and code-review improvements.
• OWASP Application Security Verification Standard (ASVS) 5.0: Web application and API testing follows OWASP ASVS controls as acceptance criteria, ensuring coverage of authentication, session management, access control, and input handling requirements.
• NIST SP 800-53 (Security and Privacy Controls, Rev. 5): The penetration testing programme satisfies the CA-8 Penetration Testing control family, providing documented evidence for authorisations that require NIST 800-53 compliance.
• ISO/IEC 27001:2022 (Annex A, Control 8.8): Regular technical vulnerability assessments and structured remediation tracking fulfil the technical vulnerability management requirements of ISO 27001, supporting certification audits.
• PCI DSS v4.0 (Requirement 11.4): The programme meets PCI DSS penetration testing requirements, including scope, methodology, retesting of failed controls, and retention of results for assessors.

Compliance#

The penetration testing programme supports compliance with:

• SOC 2: Regular security assessments and vulnerability management
• ISO 27001: Technical vulnerability management (A.12.6)
• PCI-DSS: Penetration testing requirements (Requirement 11.3)
• HIPAA: Security evaluation and testing requirements
• NIST 800-53: Security assessment controls (CA-8)
• FedRAMP: Penetration testing requirements for authorised systems

Availability#

• Enterprise Plan: Penetration testing programme included; customer-specific testing summaries available on request
• Professional Plan: Platform-level penetration testing covers all plans; customer-specific summaries available for Enterprise

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14