Authorised, manual testing
Penetration testing in Zimbabwe, done by hand. Written up so you can fix it.
We test your systems the way an attacker would, with your written permission, and hands you a report you can act on. You deal directly with the person doing the work.
Prefer to look first? Run the free passive security check. It touches nothing. Not sure which level you need? Compare a free check, an audit and a test.
What you receive
- An executive summary written for the people who decide.
- Every finding rated Critical, High, Medium or Low, with proof of how it was exploited.
- Fix steps your developers can follow, for each finding.
- Same-day notice of any critical finding while testing is still running.
- A retest after you fix, confirming each finding is actually closed.
Report within 3 working days of testing ending. Real reports stay private to the client and are never published.
What is tested
Schools, clinics and SMEs here usually start with what faces the internet: the website and any customer or patient portal, staff email, and remote access. The exact list is agreed with you in writing before any testing starts.
See roughly where your scope lands in the pentest price and scope builder. If you hold customer or patient records, pair the test with a data protection readiness assessment under the Cyber and Data Protection Act.
Web applications
Login and sessions, access control between users and roles, injection, and the rest of the OWASP Top 10.
APIs
The endpoints behind your web and mobile apps, checked for missing authentication and one user reaching another user's data.
Staff email and admin accounts
Microsoft 365 or Google Workspace settings, and the admin accounts behind them.
External network
Every service you expose to the internet, including remote access, checked for misconfigurations and weak points.
Internal network and Wi-Fi
On request, when sensitive records sit on your own servers or office network.
Vulnerability assessment
A structured scan and review of your public facing systems, every finding ranked by business risk.
Phishing simulation
On request, a controlled campaign agreed in writing first, showing how your team responds and where training is needed.
Five steps, in this order, every time
Scope and written authorisation
A short call, then a written scope and a fixed quote. Testing starts only once you have signed an authorisation naming what may be tested and when, and the commitment fee is paid.
Testing
Hands-on testing the way an attacker would work, avoiding destructive tests and stopping at once if anything looks affected. Critical findings reach you the same day.
Report
The written report, within 3 working days of testing ending, in the format shown below.
Fix
Your team or your developer closes the findings. We stay available for questions while you work through them.
Retest
We test every finding again to confirm it is actually closed, not just reported.
Who we secure
Tested around what your sector has to protect
The risk sits in different places for a school, a clinic or a lender. Your exact scope is agreed in writing before any testing starts, whichever sector you are in.
Schools, colleges and training providers
Learner records, fee payments and parent portals, often holding data about minors.
What we test: Student and parent portals, enrolment and fee forms, staff email and admin accounts.
Security for this sectorClinics and healthcare
Patient records, some of the most sensitive data the Cyber and Data Protection Act covers.
What we test: Patient portals and booking systems, what each staff role can see, remote access.
Security for this sectorLaw firms
Client files and privileged email, exactly what an attacker or a rival would want.
What we test: Email and document portals, staff accounts, file sharing and access settings.
Security for this sectorTravel agencies and tour operators
Bookings that carry passport details, and card or mobile money payments.
What we test: Booking engines and payment pages, customer accounts, admin panels.
Security for this sectorFinance, microfinance and fintech
Loan, payment and mobile money flows that move real money.
What we test: Customer portals and the APIs behind them, transaction and approval logic, one customer reaching another's data.
NGOs and development organisations
Beneficiary and donor records, often spread across partner systems.
What we test: Data collection and reporting systems, staff email, shared drives and partner access.
Not on the list? The same method applies to any business with a website, an app or customer data. Tell us what you run.
The deliverable
The report, in 30 seconds
Every finding ranked by risk, what it means for your business in plain language, how to fix it, and the retest that proves it is closed.
Read the report before you hire anyone
This is an excerpt of the sample report, in the exact format you would receive. Client, hosts and evidence are redacted.
Vanorika Technologies
Confidential, sample report
Penetration test report
- Client
- [Redacted], Harare, Zimbabwe
- Engagement
- External web application penetration test
- Scope
- 1 primary web app, 2 subdomains, public infrastructure
Findings at a glance
| # | Severity | Finding | Status |
|---|---|---|---|
| 01 | Critical | Authentication bypass on an unprotected API endpointFixed and retested | Fixed and retested |
| 02 | High | Broken access control: horizontal privilege escalationFixed and retested | Fixed and retested |
| 03 | Medium | Outdated CMS component with a known CVEReported | Reported |
| 04 | Medium | Missing security headers (CSP, HSTS)Reported | Reported |
| 05 | Low | Verbose error messages leak internal pathsReported | Reported |
Critical
VAN-2026-01
Authentication bypass on an unprotected API endpoint
- Business impact
- An attacker could enumerate and exfiltrate the entire customer database, leading to a reportable data breach under the Cyber and Data Protection Act.
- Evidence (redacted)
- GET /api/v1/customers/<id> → 200 OK (no Authorization header)
- Remediation
- Enforce authentication and object-level authorisation on every API route, and deny by default.
From $1,200, fixed before testing starts
You get one fixed figure in writing after the scoping call. A 50% commitment fee is paid before testing starts, and the balance on completion.
What raises the price
- How many targets
- Each extra app, domain or API adds testing time.
- External or internal
- Internal testing needs access to your network, on site or remote.
- Logged-in testing
- Every user role tested separately adds depth and time.
- Type of report
- A standard report, or one prepared for a board or a compliance review.
New to pentests? Read what a pentest really costs in Zimbabwe, or compare every service on the pricing page.
Before you approve it
The engagement, in facts.
- Typical timeline
- 1 to 2 weeks of testing for a web application
- Report
- Within 3 working days of testing ending, findings ranked by risk with a fix for each
- Retest
- Free retest of fixed findings within 30 days
- Standards
- OWASP, PTES, NIST SP 800-115 and CVSS
- Confidentiality
- We sign your NDA before scoping, on request
Questions, answered
- What is a penetration test, simply?
- It is hiring someone to break into your systems on purpose, with your permission, so they can tell you how before a criminal figures it out. You get a clear report of what is wrong and how to fix it.
- Will testing break or slow down my systems?
- It is very unlikely. We agree the scope and timing with you first, avoid destructive tests, and stop straight away if anything looks affected. A free passive scan, which touches nothing, is available first.
- What do you need from us before testing starts?
- A signed authorisation naming what may be tested and when, a contact who can be reached during testing, test accounts if logged-in areas are in scope, and the commitment fee.
- Do I need this if I am a small business?
- Especially if you are. Attackers target whatever is exposed, and small businesses get scanned by the same bots as everyone else. If you hold customer data or take payments, you are a target.
- How much does a penetration test cost in Zimbabwe?
- A manual penetration test starts at $1,200, and a website security audit starts at $500. The fixed price depends on how many apps, domains and logged-in roles are in scope, and whether internal systems are included. You get one written quote before any testing starts, and the pentest price builder gives you a starting figure in a minute.
- What do I actually get?
- An executive summary, every finding rated by severity, proof of how each was exploited, developer-ready fix instructions, and a retest after you fix them.
- How is this different from a free online scanner?
- A scanner runs a checklist. A real tester thinks, chains small weaknesses into real ones, and finds what scanners miss. We use both, but the human is the point.
Not sure where to start?
Two free ways in. Neither one commits you to anything, and both tell you something useful today.
Check your website first
Enter your domain for a plain-English snapshot of what anyone can already see about it.
Or open the full security checkTalk it through with us
A free 30 minute call about what you need. You leave knowing which service fits, what it costs to start, and what happens next.
Book a free 30 minute callTell us what you want tested.
A list of systems is enough to start. We reply with scoping questions and, after a short call, a fixed quote. You can also write to us.