What is a penetration test (pentesting)?

A pentest is a controlled, authorized attack against an organization's systems, networks, or applications, carried out to identify exploitable vulnerabilities before a real attacker does.

Why is Tenacron's pentesting done on-site?

Tenacron performs its penetration tests on-site, with the team physically present at the client's facilities, which allows evaluating physical and internal network attack vectors that a remote test doesn't always cover.

What role does OSINT play in a pentest?

OSINT (Open Source Intelligence) is the initial reconnaissance phase: gathering public and exposed information about the organization -domains, technologies, employees, leaked credentials- before touching any system. It gives the pentesting team the same starting point a real attacker would have.

Who offers OWASP-methodology pentesting services in Uruguay?

Tenacron Secure Solutions, based in Montevideo, Uruguay, offers pentesting and ethical hacking services using the OWASP methodology, performed on-site, as part of its Tenacron Cyber Solutions vertical.

Cybersecurity / Pentesting

Pentesting: complete methodology (OWASP, on-site)

Q: What pentesting methodology does Tenacron use?

Tenacron Secure Solutions applies the OWASP (Open Web Application Security Project) methodology, the international reference standard for assessing vulnerabilities in applications and systems, adapted to the scope of each project.

Published September 2, 2026 · Tenacron Secure Solutions

Hiring a pentest without understanding the methodology behind it is like hiring an audit without knowing which standards it applies. This guide explains how Tenacron Secure Solutions' team works: OWASP methodology, on-site execution, and what your organization receives at the end.

What is a pentest?

A pentest (penetration test) is a controlled, authorized attack against systems, networks, or applications, aimed at identifying exploitable vulnerabilities before a real attacker does. Unlike an automated vulnerability scan, a pentest includes manual exploitation and chaining of flaws to measure the real impact of a compromise.

OWASP methodology

Tenacron applies the OWASP (Open Web Application Security Project) methodology, the international reference standard for assessing the security of applications and systems, complemented with OSINT (Open Source Intelligence) techniques during reconnaissance. This means working through recognized risk categories (such as the OWASP Top 10) and a structured process in phases:

Reconnaissance (OSINT): gathering public and exposed information within the defined scope -assets, technologies, exposed surface, employees and other data available from open sources- before touching any system.
Scanning and enumeration: identifying services, versions, and potential entry points.
Exploitation: controlled attempts to leverage identified vulnerabilities, validating their real impact.
Post-exploitation: assessing how far an attacker could escalate from the access obtained (lateral movement, privilege escalation).
Reporting: technical and executive documentation of findings, with severity, evidence, and prioritized remediation recommendations.

Our approach at Tenacron: we perform pentesting on-site, with the team physically present at the client's facilities. This allows us to also evaluate vectors a remote test doesn't always cover: internal network, real segmentation between areas, connected devices, and in some cases, in-person social engineering -especially relevant for organizations with critical infrastructure or hundreds of workstations.

What types of pentesting can be performed?

Type	What it assesses
External	Internet-facing surface: websites, VPN, email, public services.
Internal	What an attacker who already has internal network access (or an insider) could achieve.
Web applications	Business logic, authentication, access control, code injection, per OWASP Top 10.
Networks / infrastructure	Firewall configuration, segmentation, network devices.
Social engineering	Resistance of the human factor against phishing or physical access attempts.

From theory to architecture: why pentesting doesn't end at the report

The team that runs pentesting at Tenacron is the same one that participates in secure architecture design. This has a direct consequence: findings don't stay as a list of vulnerabilities -they translate into concrete changes in configuration, segmentation, and controls, including, when needed, adjustments to firewalls and platforms from the brands we operate as a certified partner (Fortinet, Check Point, WatchGuard).

That same field experience -combined with having restored operations for organizations of more than 600 users after ransomware and DDoS incidents- shapes what we look for during a pentest: not just isolated technical vulnerabilities, but the ones that actually lead to serious incidents in practice.

Frequently asked questions

What's the difference between a pentest and a vulnerability scan?

A vulnerability scan is automated and detects known flaws by signature. A pentest includes manual exploitation, chaining of vulnerabilities, and validation of real impact, which requires expert human intervention.

How long does a pentesting project take?

It depends on scope. A pentest of a single web application can take 1 to 2 weeks; an internal pentest across a full corporate network usually takes longer, depending on the number of segments and assets to assess.

Does pentesting disrupt normal business operations?

It's planned together with the client to minimize impact: a work window is defined, scope is agreed in writing, and if needed, exclusions are set for critical production systems.

Want to assess the real security of your infrastructure with on-site pentesting?

Talk to a Tenacron expert