DATA SHEET

FortiGuard Penetration
Testing Service
Available in:Appliance

VirtualMachine

HostedCloud

Remote Penetration Testing
Bolstered by its long experiencein threat analysis and vulnerability
research, Fortinet is now providing its
own penetration testing service.
Throughout more than 15 years,
FortiGuard has been sharpening its
skills and tools to become one of thetop-notch worldwide cyber security research labs. FortiGuard
consists of hundreds of specialists and is credited with over1000 zero-day discoveries — a record unmatched by any othersecurity vendor.

Methodology
nDiscover Vulnerability
Understand current security shortfalls within thenetwork and critical hosts, and take appropriate
actions to secure them.
nGet Remediation Advice
Receive resolution instructions fromexperienced security experts.

Test Incident Response

These services leverage
the Open Web Application
Security Project (OWASP) toconduct a series of technicalassessments on yourorganization’s security controls
to determine the weakness
on computer hardware
infrastructure and software
application
FortiGuard’s Pentest team will
apply commercial automatedtools to discover unintended
services made publiclyavailable by your network
and we also apply real world
attackers’ methodologies
to discover unknown
vulnerabilities on the given
targetPrepare security team and test existing
monitoring tools for real attacks.

1

DATA SHEET | FortiGuard Penetration Testing Service

FEATURES
FortiGuard Pentest team offers the following remotevulnerability assessment and penetration testing service tothe companies who want to know existing security shortfalls
in their network. The service conducts technical tests on anorganization’s assets that typically involve both automatedand manual assessments.

Internal Vulnerability Assessment

External Vulnerability Assessment

To assess the risk exposure of a mobile application, including
but not limited to unauthorized access, exploitation, and data
exfiltration. We comply with OWASP Top 10 Mobile Application
Security Risks when conducting tests on mobile application.

To identify vulnerabilities on a system exposed on Internet
from an outsider point of view. It includes discovering thepublic-facing footprint of the company requesting the test.

Web Application Penetration Testing
To assess the risk exposure of a web application, including
but not limited to unauthorized access, privilege escalation,exploitation, and data exfiltration. We comply with OWASPTop 10 Application Security Risks when conducting
vulnerability assessment on the web application. Customers
may want to provide specific accounts to authenticate on theapplication.

To identify vulnerabilities on a system exposed from aninsider point of view. In that case, remote access has to beprovided with optionally the network architecture.

Mobile Application Assessment

Deliverables
After the technical phases, we prepare a vulnerability
assessment report presenting the potential issues foundduring the assessment together with risk rankings andrecommended remediation procedures. Customers canact on the issues according to severity level set as High,Medium, and Low priority, which is aligns wth the Common
Vulnerability Scoring System (CVSS) standard.

FORTIGUARD PENETRATION TESTING SERVICEFORTIPENTEST ™

Remote vulnerability assessment and penetration testing consulting service

FortiCloud automated web application scanner

Assess network application vulnerabilities and evaluate Web/ Mobile Application security
issues conforming to OWASP Top 10 and CWE

Evaluate Web Application security issues conforming to OWASP Top 10 and CWE

FortiGuard’s expert personnel will apply commercial, open-source and in-housedeveloped scanner tools along with diversified offensive methodologies to perform
manual assessment on the given target

A cloud-based scanner that can be subscribed through a different type of licensing. Uponsigning-on to FortiPenTest, the subscriber can on-demand scan designated URL(s) that they
host on public internet

ORDER INFORMATION
ProductSKU

Description

FortiGuard Penetration Testing ServiceFP-10-PT001-000-00-00

Remote penetration test of 1 web application or 1 mobile application

FP-10-PT016-000-00-00

Remote vulnerability assessment of up to 128 IP addresses

FP-10-PT032-000-00-00

Remote vulnerability assessment of up to 256 IP addresses

FP-10-PT064-000-00-00

Remote vulnerability assessment of up to 512 IP addresses

FP-10-PT128-000-00-00

Remote vulnerability assessment of up to 1024 IP addresses

FC-10-FPENT-236-02-DD

FortiPenTest Penetration testing subscription service for detection of critical vulnerabilities in websites / webapplications, including those in OWASP top 10. Each subscription covers 10 IP/FQDN

FortiPenTest

www.fortinet.comCopyright © 2022 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other productor company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and otherconditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaserthat expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, anysuch warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise
revise this publication without notice, and the most current version of the publication shall be applicable.
Fortinet is committed to driving progress and sustainability for all through cybersecurity, with respect for human rights and ethical business practices, making possible a digital world you can always trust. You represent and warrant to Fortinet that you will not use
Fortinet’s products and services to engage in, or support in any way, violations or abuses of human rights, including those involving censorship, surveillance, detention, or excessive use of force. Users of Fortinet products are required to comply with the Fortinet EULA
(https://www.fortinet.com/content/dam/fortinet/assets/legal/EULA.pdf) and report any suspected violations of the EULA via the procedures outlined in the Fortinet Whistleblower Policy (https://secure.ethicspoint.com/domain/media/en/gui/19775/Whistleblower_Policy.pdf).

FSAS-DAT-R06-20220419