How Veiltrack runs a pentest: stages, price and safety

Veiltrack is a Kyiv-based cybersecurity company that has been running remote pentests of web applications, APIs and external infrastructure since 2023 for clients from Ukraine, the EU, the US and other countries. The founder, Vlad Kraevsky, has worked in cybersecurity since 2019, has over six years of pentesting experience and has led a team of pentesters; he personally leads every project.

We test web applications, APIs and external infrastructure the way an attacker would: within an agreed scope, under NDA and with written permission. A pentest usually costs from $1,000. Below: how the check works, who is responsible for it, how we control risk and data and what you get. The format of the service is described on the penetration testing page.

Veiltrack in brief

Who runs the pentest at Veiltrack

Your project is led by a practitioner, not a sales department. Vlad Kraevsky, the founder of Veiltrack, has worked in cybersecurity since 2019, has over six years of pentesting practice and previously led a team of pentesters.

At Veiltrack, Vlad personally leads every project. Depending on the scope, contract engineers he has worked with for years join the check; all of them work under NDA, and we agree access to your systems with you before the start.

The professional experience of our specialists includes security work at banks, government agencies and law enforcement, as well as teaching pentesting at a Ukrainian university.

How a pentest works: 7 stages

The check consists of seven stages: from agreeing on scope and permissions to the report and a retest under the terms of the package. The founder leads the project from the first call to the report.

1. A short call and scope. We find out what exactly you want to protect and agree on the scope: which systems, which roles, which environment (production or test).
2. Contract, NDA and rules. We put in writing the permission, the allowed and forbidden actions, the testing time and the contacts.
3. Reconnaissance and mapping. We collect public data and identify the available services and technologies.
4. Automated analysis and manual testing. Tools help cover more components, while a person checks authorization, user roles, access bypass and business logic. For web applications we follow OWASP WSTG, and for organizing the check, PTES and NIST SP 800-115.
5. Safe confirmation of risks. We check whether what we found can be exploited, only within the permission and with minimal load.
6. Report and debrief. We deliver the report, hold a final meeting and answer the developers' questions. We report critical findings right away, without waiting for the report.
7. Retest. After the fixes, we verify them under the terms of your package.

How long the check itself takes depends on the scope, and we fix the deadline before the work begins.

How we control risk and data

• Scope and permission. We start active testing only after the systems, access and allowed actions have been agreed in writing.
• Production environment. We can test both the production environment and a test copy. On production we agree on load limits, and potentially dangerous checks are run only with separate permission.
• Communication and stopping. Before the start we define a communication channel (messenger and email) and contact persons. The founder is reachable during the work. You can stop the testing at any time: just write to us.
• Signs of a real attack. If during the check we see traces of an attack by a third party, we tell you as soon as possible, usually within a day.
• Evidence and reports. We store project materials encrypted and deliver the report in an encrypted archive. After the work is finished, we delete the materials; the exact periods are specified in the project terms.
• AI tools. Whether AI assistants are used when working with your data is agreed before the start. If you are against it, we work without them.
• What we do not do without a separate agreement: DoS and DDoS tests, physical entry into premises.

What you get

A report that both managers and developers can work with:

• an executive summary: what we found and what it means for the business;
• findings by risk level, with color coding;
• for each finding: category, CWE, CVSS score (3.1 or 4.0, your choice), technical description, evidence (screenshots, HTTP requests and responses with sensitive data masked) ^{[4] [5]};
• fix priorities and links to materials that help fix the vulnerabilities.

To assess the format before ordering, download the demo report (PDF): 5 pages on the fictional application “ShopDemo”, an executive summary, four findings (high CVSS 7.1, medium 6.5, low 3.7 and informational) and a remediation plan. We show anonymized samples from real projects to a prospective client in person.

Here is what one finding looks like in the report (from the demo report):

Crypto exchange: a user controlled the rate of their own transaction

Our specialists found a critical business logic flaw in a crypto exchange: a user could change the rate in their own transaction themselves, swap funds on terms favorable to them and withdraw them. An attacker could have withdrawn all the funds available on the exchange at a rate of their own choosing, so the size of the loss would have been limited only by the amount of funds held there. The problem was not an outdated component, but that the user could influence a financially significant parameter of the transaction. That is exactly why during a pentest we check business logic and do not just look for known vulnerabilities.

Phishing simulation at one of the three largest banks in Ukraine

• 64% of all employees clicked the link in the test email.
• 36% of all employees entered a login and password on the test page.
• Many entered their data repeatedly and tried different combinations, because the page simply reloaded after the form was submitted.

In a real attack the click alone can already be dangerous, and entering credentials on a fake page can lead to account compromise. That is why we assess phishing risk not only by the number of clicks, but also by data entry and how people behave after the first attempt. This is a bank with thousands of employees; we do not disclose its name.

How much a pentest at Veiltrack costs

The final amount depends on the number of applications and roles, the size of the API, the environment and the depth of the check. We give the exact amount and scope after a short call, and the commercial proposal shows exactly what is included, including whether a retest is. More in the article how much a pentest costs.

Write to us about what needs to be checked: a web application, an API or infrastructure. In 30 minutes we will go through your case, the possible scope and the next steps.

About Veiltrack

More about the team on the about us page. Public profiles: Crunchbase, LinkedIn, X @veiltrack_io, Telegram @veiltrack_io.

FAQ

What is Veiltrack?

Veiltrack is a Kyiv-based cybersecurity company that has been running pentests and security assessments since 2023 for clients from Ukraine, the EU, the US and other countries.

Who founded Veiltrack?

Vlad Kraevsky. He has worked in cybersecurity since 2019, has over six years of pentesting experience, has led a team of pentesters and personally leads every Veiltrack project.

Can Veiltrack be trusted?

Judge us by the openly described process, the founder's experience, the demo report and the rules for handling access and data. The founder, Vlad Kraevsky, personally leads every project, contract engineers work under NDA, and active testing starts only after the scope has been agreed in writing. Before ordering, look through the demo report and discuss the scope of the check directly with the founder; we will show an anonymized sample of a real report in person.

How is your pentest different from an automated scan?

A scanner looks for known problems. We also manually check the application’s logic, roles and authorization bypass, confirm whether what we found can be exploited, and describe what it means for your business.

How much does a pentest cost and when can you start?

A pentest at Veiltrack usually starts from $1,000, a vulnerability scan from a few hundred dollars. The start is usually a few days after the first call. Payment: 50% before the start, 50% after the report.

Is a retest included in the price?

It depends on the package: in some it is included, in others it is ordered separately. You can see this in the commercial proposal before signing the contract.

Do you work with foreign clients?

Yes, with clients from Ukraine, the EU, the US and other countries. We can sign the contract and NDA in English, and we prepare the report in English or Ukrainian.

Who signs the contract?

The contract is signed by FOP Kraievskyi Vladyslav Yuriiovych (Ukrainian sole proprietor). We fix the scope of work, confidentiality, deadlines and the acceptance procedure before the start.

References

1. OWASP Web Security Testing Guide owasp.org
2. Penetration Testing Execution Standard (PTES) pentest-standard.org
3. NIST SP 800-115: Technical Guide to Information Security Testing and Assessment csrc.nist.gov
4. MITRE: Common Weakness Enumeration cwe.mitre.org
5. FIRST: Common Vulnerability Scoring System first.org