At PolarSec, we believe pentesting is more than just a checkbox for compliance, it’s a powerful tool to help organizations grow and mature their security posture. Whether you’re a small business building your first defenses or a larger enterprise ready for advanced red or purple teaming exercises, our tailored approach helps you strengthen security where it matters most.
Result and impact is what drives us. We believe that offensive security can be a great tool for continuous improvement. But pentesting is only as good as its scoping.
This is why our collaboration with new customers always begins with a short, no-cost, technical assessment: a two-day offensive review of the corporate network that highlights real risks. Unlike traditional scoping sessions, this assessment uncovers key exposures first, so that auditing efforts are concentrated where it matters most.
Moreover, finding vulnerabilities is only the beginning. Fixing them makes the real difference.
Hence, we do not stop at pentesting. We go beyond: we help you find solutions and implement them.
This program helps small to mid-sized businesses quickly strengthen their security posture through focused offensive testing, architecture auditing, and hands-on remediation support. It’s designed for teams that want results, not just reports.
Based on the analysis of previous work and business context, a customized testing plan is proposed. This may include internal and external network penetration testing, web and mobile assessments, Active Directory reviews, Wi-Fi security testing, source code audits, or configuration reviews, adapted to the customer’s environment and priorities.
Vulnerabilities aren’t just reported; they’re validated post-remediation. Direct collaboration with IT teams ensures security gaps are addressed and verified effectively. If needed, a STRIDE-based threat model is developed to guide future efforts and give leadership a clear understanding of technical risks.
Healthcare cannot afford downtime. Hospitals and clinics rely on systems that must stay available around the clock, and connected medical devices now sit at the heart of patient care. An attacker does not see a hospital network and a bedside device as separate problems, and neither do we.
This offering covers the full healthcare environment, from clinical networks, patient portals and APIs down to the connected medical devices (IoMT) running on top of them. It is designed for both medical device manufacturers who need to demonstrate the security of their products, and healthcare organizations who need to trust the devices they already operate.
For device manufacturers, hands-on offensive testing covers hardware, firmware, mobile companion apps, cloud backends and wireless interfaces such as Bluetooth Low Energy and Wi-Fi. Testing is driven by the device’s threat model, and results are delivered as independent evidence that can be included in FDA and Health Canada premarket cybersecurity submissions. When needed, we help build or review the threat model itself.
For hospitals and clinics, assessments validate the security of the devices already deployed and their integration into the clinical network: segmentation, exposed services, default credentials, and the paths an attacker could take from the corporate IT network to patient care systems. Testing is planned around clinical constraints, with less intrusive techniques where production systems cannot be disrupted.
Findings also feed directly into your privacy and compliance work, including the privacy impact assessments required under Quebec’s Loi 25.
AI features are shipping faster than they are being secured. Chatbots, copilots and autonomous agents connect language models to your internal data, your APIs and your tools. Each of these connections opens attack paths that traditional pentesting was never designed to cover.
This service is designed for companies integrating LLMs into their products or internal workflows, whether through third-party models or self-hosted ones. The objective is simple: find out what an attacker can make your AI do before it reaches your customers.
Assessments are based on the OWASP Top 10 for LLM Applications and go beyond it. We test for direct and indirect prompt injection, jailbreaks and guardrail bypasses, leakage of system prompts and sensitive data, and poisoning of the documents and sources used in retrieval-augmented generation (RAG) pipelines.
When models are given tools, plugins or autonomous actions, we evaluate what an attacker can achieve through them: excessive permissions, unsafe tool calls, privilege escalation and access to data the user should never see. The model is never tested in isolation; the surrounding APIs, authentication, and infrastructure are audited as part of the same engagement.
Results come with concrete remediation guidance adapted to your architecture, from prompt and guardrail hardening to permission design and output validation.
A response plan is only as good as the people executing it under pressure. When a real incident hits, decisions must be made fast, with incomplete information, by teams that rarely work together. The worst moment to discover the gaps in your plan is during the crisis itself.
Our scenario-based tabletop exercises put your executives, IT, legal and communications teams through a realistic cyber crisis, in a safe setting. Our offensive background allows us to build scenarios that reflect how real attacks actually unfold, not generic textbook cases.
Each scenario is tailored to your sector, your systems and your threat profile: ransomware, data breach, supply chain compromise, or attacks on operational and clinical systems. Injects evolve as the exercise progresses, based on the decisions made by participants, recreating the uncertainty and time pressure of a real incident.
The exercise tests far more than technical response: escalation paths, decision-making authority, communication with customers, regulators and the media, and coordination with external partners such as insurers and incident response providers.
At the end of the session, you receive a clear assessment of the gaps observed in your response plan and a prioritized list of improvements. Exercises can be repeated over time to measure progress and train new team members.
Improve the technical security maturity of your product and reduce costs by embedding security throughout the development lifecycle. Our consulting services bring together security design, offensive security assessments and automation at each stage of the development process.
This à la carte offering is designed for development companies and engineering teams that need security to keep pace with delivery. By aligning with development milestones, this service reduces late-stage surprises and strengthens product resilience from the first commit to final release.
Security is introduced early, with support for secure architecture design, threat modeling, and the definition of clear security requirements aligned with IEC 62443. Combined black-box and white-box techniques are used to maximize coverage during assessments, and penetration testing is strategically performed at key development stages to detect regressions and emerging risks.
Secure coding guidance, CI/CD pipeline hardening, and integration of automated tools ensure that security becomes part of the workflow—not a bottleneck. Developer training is also available, helping teams improve their security practices internally.
Purple Teaming is the best way to evaluate and improve your detection methods and procedures. Purple Team engagements bridge the gap between offense and defense by aligning the Red and Blue teams around a common goal: improving your detection and response.
Purple Team engagements bring Red and Blue teams into the same room. While attacks are performed following the MITRE framework, detection capabilities are evaluated: has the attack been detected, what events have been triggered, is it possible to bypass this detection? Let’s see how to make things better.
Instead of just reviewing logs after the fact, your analysts get to see the threat unfold live and learn to distinguish signal from noise, recognize attacker behaviors, and validate that alerts are firing, when and where they should.
This isn’t a test, it’s a training ground, where each missed detection becomes a lesson and each successful alert becomes a reference. Together, we identify gaps, fine-tune alerting logic, and elevate your detection engineering game.
As threats are getting more ubiquitous, companies start to worry about the cyber impacts of targeted attacks and ransomware threats. We can either intervene before production, assessing the security of your OT network in depth, or in production, leveraging less intrusive ways to audit your network without disruption.
Security of industrial control systems has been forgotten or put aside for a long time.
When it comes to ICS security, the best possible solution remains in our opinion to perform offensive assessments pre-production (or even better, in laboratory environments), allowing to identify and to remediate major issues before production.
Testing OT systems in production cannot be performed the same way, without risking unacceptable disruptions. In those circumstances, we leverage configuration auditing and architecture auditing. Focus is put on the interconnections with OT networks (e.g. IT), through pentesting, and evaluation of the zero-trust models.
Technologies such as Active Directory are more and more common in OT infrastructures, with all the benefits and risks associated with it.
Every situation is different. Let’s talk and see how we can help.
Evaluate your Blue team with Red Teaming exercises. This type of exercise is designed to challenge detection and response capabilities. Red Teaming challenges the defenses end-to-end and at the same time evaluates the detection in realistic conditions.
Even fancy tools need to be well configured to be efficient.
Red Teaming are highly customized, stealthy assessments through realistic, business impact-oriented attacks that closely replicate the techniques used by Advanced Persistent Threats (APT) actors.
Red Team operations are conducted using custom tooling, malware, and dedicated attack infrastructures developed in-house to simulate advanced and persistent threats: breaching the perimeter, pivoting on the internal network, and targeting your crown jewels.
Contrary to pentesting exercises, Red Teaming is not meant to evaluate the security posture. Though vulnerabilities are discovered and exploited along the way, Red Teaming involves an opportunistic rather than exhaustive approach.
Offensive assessments allow to identify vulnerabilities and security design issues in your products before someone else does, avoiding reputational and commercial costs. By identifying new classes of bugs, development practices can be improved sustainably.
Assessments cover a wide range of technologies, from smart sensors to SCADA systems, heavy clients, protocolar stacks, kernel drivers, …
For all kinds of sectors, all with their constraints and specificity, whether for consumer market, industrial, transport, energy, medical, financial or even military.
A testing plan is built to test methodically the attack surface and security functions, leveraging your functional testing and source code if provided.
We adapt our testing effort to the product’s threat model (or can help you with designing one if needed) only on the attack surface and in the conditions that really make sense, targeting the most feared scenarios.
In addition to the interfaces, the efficiency of the security functions is evaluated, complementary to the work done as part of product certifications such as IEC62443.
Internal and External Pentesting exercises aim at identifying weaknesses exposed by the organization respectively on the internal and external attack surface. These are the most efficient tools to evaluate the security posture of the organizations’ infrastructures. As such, external and internal pentests are often required as part of SOC2 compliance.
External pentesting engagements mimics the strategies and techniques employed by malicious actors attempting to breach an organization’s network from the outside.
The external attack surface evaluated in these assessments is the assets owned and exposed by the organization directly on internet, whether it is self or externally hosted. Such assessments mimic the techniques and strategies used by malicious opportunistic actors.
Internal pentest exercises aim at simulating an attacker with internal access to the client’s network, in a situation where the external security perimeter has been breached. In these circumstances, attackers with or without credentials could try to compromise internal assets and elevate their privileges to access sensitive information or cause damage.
Internal pentesting engagements are the continuity of external ones.
Identify vulnerabilities in your web based applications before attackers do. Web, API and mobile pentesting assessments allow to identify a wide range of vulnerabilities. A very cost efficient way to evaluate the security stance of your applications and to put it to the test against realistic threats. You might be surprised.
The security of web applications is evaluated through simulated attacks that mimic real-world threat scenarios. The pre-authenticated as well as the authenticated features of the application are evaluated, considering the different roles offered.
Using a combination of manual and semi-automated testing, applications are thoroughly tested to identify potential weaknesses and vulnerabilities, covering all categories of the OWASP and more.
Mobile applications and backend APIs are audited to uncover security issues related to the way data is transmitted, handled, and accessed between systems. The objective is to reveal flaws that could affect the reliability, confidentiality, or proper functioning of mobile services in real-world conditions.
Humans are often described as the weakest link in the security of organizations. Until they’re trained. Our tailored phishing campaigns and social engineering simulations test your team’s awareness and readiness, providing insight and education without compromising morale.
We propose a couple of scenarios and choose one together, each tailored to your environment and threat profile.
Campaigns can be launched in one wave or gradually over time, simulating real-world phishing campaigns.
Users are tested against different types of traps at multiple levels: clicking on a link, entering credentials into a fake login page, downloading an attachment, or even executing a payload.
These aren’t just canned emails. Each campaign is crafted to reflect usual attacker tradecraft by leveraging pretexts, urgency, and familiarity to test how your team reacts.
Once the campaign concludes, we deliver a detailed breakdown of user behavior, success rates, and engagement patterns, backed by clear, actionable metrics. Our goal isn’t to shame, but to inform and train.
Our approach to code review is that it should generally not cost you more than a black-box pentest, but it should provide better results. Code review allows to find vulnerabilities much more rapidly and sometimes that may not be detectable during black-box testing.
Reviewing directly the source code instead of the response of the application, allows security issues to be found directly within the logic and structure of the code.
Moreover, code review is sometimes the only available option to evaluate the quality of a code base in specific constrained systems that cannot be easily tested.
In our experience, code review works the best when associated with pentesting. This dual approach (top-down and bottom-up) allows us to audit the code and trigger the response of the application at the same time.
Connected medical devices are now part of patient care, and part of your attack surface. An infusion pump, a patient monitor or an imaging system can be the entry point to a hospital network, or the target itself. Our offensive assessments identify these weaknesses before they affect patient safety.
Medical devices are assessed the way an attacker would approach them: hardware debug interfaces (UART, JTAG, SWD), firmware extraction and analysis, wireless communications such as Bluetooth Low Energy and Wi-Fi, companion mobile applications and cloud backends.
For manufacturers, the testing effort is driven by the device’s threat model and produces independent evidence that can support FDA and Health Canada premarket cybersecurity submissions.
For hospitals and clinics, we evaluate the devices already in place and how they are integrated into the clinical network: exposed services, default credentials, insecure protocols and network segmentation.
Clinical environments come with constraints. Testing is planned with your biomedical and IT teams, and less intrusive techniques are used whenever production devices cannot be disrupted.
Chatbots, copilots and AI agents are connected to your data and your tools, and they can be manipulated with nothing more than well-crafted text. Our AI and LLM assessments show what an attacker can really make your AI do, before your customers or your competitors find out.
Testing is based on the OWASP Top 10 for LLM Applications. It covers direct and indirect prompt injection, jailbreaks and guardrail bypasses, and the leakage of system prompts or sensitive data.
Retrieval-augmented generation (RAG) pipelines are tested for poisoning: a single malicious document in your knowledge base can be enough to hijack the model’s behavior.
When the model can call tools, plugins or APIs, we evaluate what an attacker can achieve through it: excessive permissions, unsafe actions, privilege escalation, or access to other users’ data.
The model is never tested in isolation. The surrounding web application, APIs, authentication and infrastructure are assessed in the same engagement, because that is where most real-world impact happens.
Incident response plans are often written once and never tested. Tabletop exercises put your teams through a realistic cyber crisis, in a safe setting, so you find the gaps in your plan before a real attacker does.
Scenarios are built from real attacker tradecraft and tailored to your sector, your systems and your threat profile: ransomware, data breach, compromised supplier, or an attack on operational systems.
Participants are not limited to IT. Executives, legal, communications and operations teams are brought together, because a cyber crisis is first and foremost a business crisis.
The exercise unfolds through injects that evolve based on the decisions made around the table. Who decides to isolate the network? When do we notify the regulator? What do we tell the media? The pressure is simulated, the lessons are real.
At the end of the session, we deliver a clear assessment of what worked, what didn’t, and a prioritized list of improvements for your response plan.
Your wireless network extends past your walls, into the parking lot and the building next door. Wireless pentesting evaluates whether an attacker within radio range can get onto your network without ever setting foot inside.
Corporate and guest Wi-Fi networks are assessed for weak authentication, misconfigured WPA2/WPA3-Enterprise setups, credential capture through rogue access points, and the segmentation between guest, corporate and sensitive networks.
Beyond Wi-Fi, other radio technologies can be assessed when relevant to your environment: Bluetooth and Bluetooth Low Energy, RFID and NFC badge systems, or proprietary radio protocols used in industrial and IoT devices.
Testing is performed on site, in realistic conditions, from the places an attacker would actually stand.
Wireless testing is a natural complement to internal pentesting: once on the network, how far can an attacker go?