International Penetration Testing Networks, applications, APIs, cloud and wireless, tested by our own consultants under written authorization

01Definition

What is international penetration testing and how does it differ from a scan?

A penetration test is a controlled attempt to break into systems the way a capable attacker would, with permission, within agreed limits, and with a written record of every step. The point is not to produce a long list of theoretical problems. The point is to show which weaknesses can actually be chained together to reach something that matters: customer data, payment systems, domain administrator rights, source code, a production database or the ability to move money.

International penetration testing applies that discipline to organizations whose technology does not stop at a border. A manufacturer may run its ERP from a data center in Germany, its e-commerce platform from a cloud region in Ireland, its plant networks in Mexico and its sales offices in Dubai and Sao Paulo. Each location has its own network team, its own internet providers, its own local suppliers and often its own interpretation of group security policy. Attackers look for the weakest of those locations and then use the trust between them. A useful test looks at the estate the same way.

A vulnerability scan is something different. A scanner compares software versions and configurations against a database of known issues and prints the results. Scans are cheap, fast and worth running often, but they produce false positives, miss logic flaws entirely and say nothing about whether an issue can be exploited in your specific environment. A penetration test uses scanning as one input and then applies human judgement: confirming findings, discarding noise, exploiting what can be exploited safely and documenting the path an attacker would take.

• A scan tells you what might be wrong; a penetration test shows what an attacker can actually do with it.
• A scan is automated and repeatable; a penetration test depends on the skill and judgement of the people running it.
• A scan rarely finds broken access control, business logic flaws or chained attacks; a penetration test is designed to find them.
• A scan can run without much coordination; a penetration test needs a signed authorization, a defined scope and agreed emergency contacts.

02Who tests

Who performs Delator's penetration testing, and on what authority?

Penetration testing is not private investigation work, so Delator does not route it through its investigator network. Every test is planned and carried out by Delator Group's own consultants and testers. That matters for confidentiality, for consistency of method across countries and for accountability: one engagement lead owns the plan, the testing and the report, and the same standards apply whether the target is an office in Johannesburg or a cloud tenant in Frankfurt.

The people on Delator's bench come from varied backgrounds. They include consultants with U.S. military intelligence and Department of Homeland Security experience, former law enforcement officers from many kinds of agencies, former bail enforcement agents who understand how people find and exploit gaps, and technology specialists across networking, software development, cloud engineering, identity and digital forensics. The wider Delator network holds a broad range of licences and certifications. Delator does not claim agency endorsements, and those backgrounds describe the people, not any government sponsorship of the work.

Authority to test comes from one place only: a written authorization signed by the owner of the systems. That document sets out the rules of engagement, the exact scope, the testing window, the techniques that are allowed and forbidden, and the emergency contacts on both sides. If a system is hosted or managed by a third party, the authorization must cover that party too, or the system comes out of scope. Delator does not test anything on the strength of a verbal request or an email from someone who cannot bind the owner.

When the scope includes people as well as systems

Some clients ask for background checks on administrators, contractors or employees as part of a wider security review. In that case, Delator leverages a locally licensed partner in its network to complete that work and does not do it itself. The technical testing stays with Delator's consultants, and the background screening is handled separately under the local licensing and data protection rules that apply to it.

03Test types

Types of penetration test Delator runs across countries

Most international penetration testing programmes combine several test types rather than one large exercise. The right combination depends on where the risk sits, what regulators and customers expect, and how much has changed since the last test. The table below summarizes the main types and what each one is designed to answer. Later sections explain how each is run in practice and what tends to go wrong in multinational environments.

04Networks

External and internal network penetration testing for multinational estates

In international penetration testing, external work begins with discovery. Large groups rarely have a complete list of their own internet-facing assets. Subsidiaries register domains, local IT providers stand up remote access appliances, marketing agencies host microsites and acquired companies bring their own address ranges. Delator's consultants reconcile what the client believes it owns with what public sources, certificate transparency logs, DNS records and routing data show. Anything that turns up outside the agreed list is reported to the client for a scope decision rather than tested.

Once the scope is confirmed, testers probe exposed services for weaknesses an attacker would use: unpatched VPN and firewall appliances, remote desktop exposed to the internet, default credentials on management pages, weak mail configuration that allows spoofing, and forgotten test systems. In multinational estates the most serious external findings are often in the smallest locations, where a single unpatched device sits in front of a site that still has full trust into the corporate network.

Internal testing assumes an attacker has already got in, through phishing, a compromised supplier or a malicious insider, and asks how far they can go. In most organizations that means Active Directory. Testers look at how credentials are stored and reused, whether old protocols are still enabled, whether service accounts have excessive rights and whether trust between domains or forests in different countries allows a compromise in one region to spread to all of them. They also test whether segmentation between sites, business units and sensitive zones works as designed.

Running internal tests across several countries

Internal testing can be done on site or remotely through a small testing device or virtual machine that the client places on the network. Remote delivery reduces travel and lets one team cover several countries in sequence. On-site work is still useful where networks are physically isolated, where a test needs to be combined with a physical assessment, or where local staff need to observe. Delator agrees the delivery method per location during scoping.

• Credential exposure and reuse across regional domains
• Excessive privileges held by service accounts and legacy administrators
• Lateral movement paths between countries and business units
• Segmentation failures between office, data center and OT networks
• Detection gaps: what the security operations team saw, and when

05Applications

Web application, API and mobile app testing

Applications are where most sensitive data is actually read and changed, and they are where automated tools are weakest. A scanner can find a missing security header. It cannot tell that a customer in one country can download another customer's invoices by changing a number in a request, or that a discount can be applied twice by replaying a call. Those are the findings that lead to breaches and regulatory reports, and they come from a tester who understands what the application is supposed to do.

Delator's application testing is structured around the OWASP Web Security Testing Guide and, where a client wants a defined assurance level, the OWASP Application Security Verification Standard. Testers work through authentication, session management, authorization, input handling, business logic, file handling and error handling, and they test with accounts at each privilege level the client provides. Multi-tenant platforms get particular attention, because a single authorization flaw in a shared platform can expose every customer at once.

APIs deserve their own scope. Modern web and mobile front ends are thin, and the real rules are enforced, or not enforced, in the API behind them. The OWASP API Security Top 10 is a useful checklist here, with broken object level authorization consistently near the top. Mobile apps are tested against the OWASP Mobile Application Security Testing Guide, covering local data storage, certificate validation, hard-coded secrets, and how the app behaves on rooted or jailbroken devices. Where an app is distributed in several regions, testers check that regional builds and back ends are configured consistently.

• Authenticated testing at every role, including administrator and partner accounts
• Tenant isolation checks for platforms that serve many customers
• Business logic abuse: pricing, refunds, approvals, workflow bypass
• Token handling, session expiry and single sign-on integration
• Regional differences in configuration, language versions and payment integrations

06Cloud

Cloud and identity penetration testing on AWS, Azure and Google Cloud

Cloud environments fail in different ways from data centers. The usual problem is not an unpatched server but a permission that is too broad, a storage bucket that is public, a key committed to a code repository, or an identity that can assume a role nobody remembers granting. Cloud testing therefore combines a configuration review with hands-on attack paths: starting from a low-privileged identity or an exposed workload, can a tester reach sensitive data or take control of the account?

Each of the major providers publishes a policy for customer penetration testing. In broad terms, most common services can now be tested without asking the provider first, but every provider restricts certain activities, such as denial-of-service testing and attacks against the provider's own shared infrastructure. Delator reads the current policy for each provider in scope during planning and writes the relevant limits into the rules of engagement. Testing is confined to the client's own accounts, subscriptions and projects.

Identity is the control plane of most modern organizations. Microsoft Entra ID, Okta and similar services decide who can reach email, file storage, finance systems and cloud consoles. Testers look at conditional access gaps, legacy authentication that bypasses multi-factor controls, risky application consents, guest accounts from former partners, and how on-premises directories synchronize with cloud identity. A single overlooked synchronization account can turn an internal network compromise into a full cloud compromise.

Multi-region and multi-account considerations

International groups often run separate cloud accounts per country or business unit, sometimes with different providers. Testers map the trust relationships between those accounts, check whether central logging captures activity from every region, and confirm that data residency commitments made to customers or regulators are reflected in where data actually lives. Findings are reported per account and as cross-account attack paths.

07Wireless and OT

Wireless testing and operational technology considerations

Wireless networks extend the network beyond the walls of the building. Testing checks whether corporate Wi-Fi uses strong authentication, whether guest networks are properly separated from internal systems, whether someone outside the building can capture credentials with a fake access point, and whether unauthorized access points have been plugged into the network by staff or contractors. In shared office buildings, which are common for regional sales offices, testers also check whether neighbouring tenants can see or reach the client's networks.

Operational technology needs a different approach. Industrial control systems, building management systems and plant networks often run equipment that was never designed to be probed, and an aggressive scan can stop a process or damage equipment. Delator's consultants treat OT scope with caution: passive observation and architecture review first, active testing only against agreed systems, during agreed windows, with plant engineers present and a clear stop procedure. Many clients choose to test the boundary between IT and OT rather than the control systems themselves.

Recognized references for this work include the ISA/IEC 62443 series of standards for industrial automation and control system security, and NIST SP 800-82, the U.S. guide to operational technology security. These frameworks emphasize zones and conduits, meaning defined areas of the plant network and controlled paths between them. A useful OT-aware penetration test checks whether those zones and conduits exist in practice, not just on the network diagram.

• Passive traffic analysis and asset discovery before any active testing
• Testing of remote access paths used by vendors and integrators
• Verification of the separation between corporate IT and plant networks
• Agreed exclusions for safety systems and fragile controllers
• Plant engineering staff on call during every active window

08Legal basis

Rules of engagement and legal authorization for cross-border testing

Without authorization, a penetration test is simply unauthorized access to a computer system, which is a criminal offence in most countries. In the United States the Computer Fraud and Abuse Act applies, in the United Kingdom the Computer Misuse Act 1990, and most other jurisdictions have equivalent laws. The signed authorization is therefore not paperwork for its own sake. It is the legal basis on which the testers act, and it must be signed by someone with the authority to grant access to every system in scope.

International penetration testing raises questions that single-country tests rarely raise. Who owns the systems in each country: the parent, a local subsidiary or a joint venture partner? Is a local IT outsourcer or managed security provider running the equipment under a contract that requires its consent? Are any systems hosted by a third party whose terms forbid testing? Delator works through these questions during scoping, and any system whose ownership or consent position is unclear is left out until it is resolved.

Data protection law also matters. A tester who gains access to a database will see personal data, and under the EU General Data Protection Regulation and similar laws the client remains responsible for how that data is handled. Delator's rules of engagement limit data access to what is needed to prove a finding, prohibit bulk extraction, define how evidence is stored and when it is destroyed, and set out how any data leaves the country where it is held. Where needed, a data processing agreement sits alongside the authorization.

What a Delator rules of engagement document covers

Delator will not begin until every item is agreed in writing. If the scope changes mid-engagement, the authorization is amended and re-signed before the new systems are touched.

• Named systems, address ranges, domains, applications and cloud accounts in scope, and explicit exclusions
• Testing windows per country and time zone, including blackout periods
• Permitted and prohibited techniques, such as no denial of service and no destructive actions
• Emergency contacts on both sides and the procedure for stopping a test immediately
• Handling of credentials, personal data and evidence, including retention and destruction
• Third-party consents for hosted or managed systems
• Signatures from a person with authority to bind the system owner

09Compliance

Regulatory and compliance drivers for international penetration testing

Many organizations commission testing because a standard, regulator or customer requires it. The requirements differ in what they ask for, how often and who may perform the work, so it is worth being precise about which one a test is meant to satisfy. A test designed for PCI DSS looks different from a test designed to give a board confidence in its cloud estate, and a report written for one audience may not satisfy another.

Some regulated testing programmes have their own rules about who may deliver them. Threat-led testing under the Bank of England's CBEST framework and the European Central Bank's TIBER-EU framework, and threat-led penetration testing under DORA, involve specific provider requirements, threat intelligence phases and regulator involvement. Delator tells clients plainly during scoping when a programme carries provider requirements that need to be checked, and can run preparatory exercises that help a firm get ready for a formal regulatory test.

10Methodology

Penetration testing methodology: PTES, NIST SP 800-115, OWASP and MITRE ATT&CK

A documented methodology is what separates a professional test from someone trying things until something works. It makes results comparable from year to year, makes coverage visible to auditors and lets the client see what was and was not tested. Delator's testing draws on the Penetration Testing Execution Standard, which breaks an engagement into pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation and reporting, and on NIST SP 800-115, the U.S. technical guide to information security testing and assessment.

For applications, the OWASP Web Security Testing Guide, the Application Security Verification Standard and the Mobile Application Security Testing Guide provide the detailed test cases. For network and adversary behaviour, testers map their techniques to MITRE ATT&CK, the public knowledge base of tactics and techniques observed in real attacks. Mapping to ATT&CK lets a client's security operations team see exactly which techniques were used, check which ones their monitoring detected and close the gaps in a targeted way.

Severity ratings use the Common Vulnerability Scoring System where a standard score is useful, adjusted with plain-language context about the client's environment. A medium-rated issue on an isolated test server and the same issue on a payment gateway are not the same risk, and the report says so. Every finding includes evidence, the steps to reproduce it, the business impact and specific remediation advice.

• Pre-engagement: scope, authorization, contacts, data handling
• Reconnaissance and asset discovery within the agreed scope
• Vulnerability analysis combining tools and manual review
• Controlled exploitation to confirm real impact
• Post-exploitation limited to what proves the finding
• Reporting mapped to recognized frameworks

11Reporting

Reports, debriefs and retesting after remediation

The report is the part of the engagement that outlives the testing window, so it is written for two audiences. The executive summary explains in plain English what an attacker could achieve, which business processes are exposed, how the results compare with the client's stated risk appetite, and what should be fixed first. The technical section gives engineers everything they need to reproduce and fix each issue: affected systems, evidence, steps, severity and remediation guidance.

In international penetration testing, findings are reported both by country or entity and across the group. Local IT teams need their own list of actions. Group security and the board need to see patterns: the same misconfiguration repeated in eight subsidiaries, a shared identity weakness that links every region, or a single acquired company that represents most of the risk. Delator structures the report so both views are available without duplicating the content.

After the client has fixed the findings, Delator retests them and issues a letter recording which issues are closed and which remain open. Retesting is the step most often skipped and one of the most valuable, because a fix that looks complete in a change ticket is not always complete on the system. A retest letter is also what many customers, auditors and insurers actually want to see.

• Executive summary written for leadership, legal and compliance readers
• Technical findings with evidence and reproduction steps
• Per-country and per-entity action lists
• Group-wide themes and root causes
• Live debrief with technical and leadership audiences
• Retest and closure letter after remediation

12Planning

How to scope and prepare for an international penetration test

Good scoping saves money on international penetration testing. The first conversation should cover why the test is needed, what systems and countries are in play, what changed since the last test, and who will receive the report. Clients often find that a narrower, deeper test of the systems that actually carry risk is more useful than a broad, shallow test of everything. Delator's engagement lead will say so when that is the case.

Clients also choose how much information to give testers. In a black-box test the testers start with little more than a company name, which is realistic but spends time on discovery. In a grey-box test they receive accounts and basic documentation, which is the most common choice for applications. In a white-box test they see architecture diagrams, configuration and sometimes source code, which gives the deepest coverage in the shortest time. The choice should follow the question the client wants answered.

Practical preparation makes testing smoother: confirm system ownership in each country, obtain third-party consents early, create test accounts, warn the security operations team or decide deliberately not to, schedule around trading peaks and local holidays, and make sure someone with authority is reachable throughout every testing window. Delator provides a preparation checklist with every proposal.

• Define the purpose: compliance, assurance, customer request, merger or incident follow-up
• List countries, entities, systems and third parties involved
• Choose black-box, grey-box or white-box testing per target
• Decide whether the security operations team will be told
• Agree reporting format and audiences before testing starts

Step by step

How an Engagement Works

1. 01

   Scoping call

   Delator's engagement lead discusses purpose, countries, systems and drivers, and identifies ownership or consent questions early.

2. 02

   Proposal and preparation checklist

   A written proposal sets out test types, approach, estimated effort and what the client needs to prepare in each location.

3. 03

   Signed authorization

   The system owner signs the rules of engagement covering scope, dates, techniques, data handling and emergency contacts. No testing happens before this.

4. 04

   Testing

   Delator's own consultants carry out the agreed tests, keeping the client's contacts informed and stopping immediately if anything unexpected occurs.

5. 05

   Critical finding alerts

   Serious issues that put the client at immediate risk are reported straight away rather than held for the final report.

6. 06

   Report and debrief

   The client receives an executive summary, technical findings and per-country actions, followed by a debrief for technical and leadership audiences.

7. 07

   Retest

   Once fixes are in place, Delator retests the findings and issues a closure letter for auditors, customers or insurers.

Deliverables

What You Receive

• Signed rules of engagement and scope document for every country in the engagement
• Executive summary describing what an attacker could achieve and what to fix first
• Technical findings report with evidence, reproduction steps, severity and remediation guidance
• Per-country and per-entity action lists for local IT teams
• Attack path narratives mapped to MITRE ATT&CK techniques
• Debrief sessions for engineering, security operations and leadership
• Retest results and closure letter after remediation
• Evidence handling and data destruction confirmation at the end of the engagement

Industries

Who Uses Penetration testing Services

• Financial services and fintechPayment systems, PCI DSS obligations and DORA testing expectations make regular, well-documented international penetration testing a routine need.
• ManufacturingPlants in several countries combine corporate IT, remote vendor access and operational technology that must be tested with care.
• SaaS and technologyMulti-tenant platforms and APIs need authorization testing that customers and investors ask to see evidence of.
• Healthcare and life sciencesPatient and trial data across regions creates data protection exposure that testing helps quantify.
• Retail and e-commerceRegional storefronts, payment integrations and loyalty platforms create a wide and frequently changing attack surface.
• Logistics and transportDistributed depots, partner integrations and tracking systems link many networks with differing levels of control.
• Professional servicesLaw, accounting and consulting firms hold client confidential data and face detailed security questionnaires from those clients.

Credentials

Who Does the Work

Delator Global's consultants come from backgrounds where finding facts under pressure is the job: U.S. military intelligence, the Department of Homeland Security, former law enforcement officers of every kind, former bounty hunters, and technology specialists across networks, applications, forensics and data. Behind them sits a network of locally licensed partners holding a wide range of licences and certifications, so every part of an engagement is done by someone entitled to do it in that country.

• Military intelligenceCollection planning, analysis and reporting discipline.
• Homeland securityFederal investigative and border, trade and financial crime experience.
• Law enforcementInterviewing, evidence handling and courtroom testimony.
• Bail enforcementLocating people who do not want to be found, lawfully.
• TechnologyNetwork, application, cloud and forensic specialists.
• Licensed partnersLocal licences for the work local law reserves.

Related services

Related Delator Global Services

• Penetration testingPhysical Penetration TestingDelator Global carries out physical penetration testing for organizations that need to know whether their buildings actually keep the wrong people out.
• Penetration testingSocial Engineering Testing and Red Team ExercisesDelator Global runs social engineering testing and red team exercises for organizations that want to know how their people, processes and defences hold up against a determined attacker.
• CyberCyber InvestigationsCyber investigations establish what happened during a security incident or digital fraud, how the attacker got in, what they touched, and what evidence exists to support recovery, notification and legal action.
• ConsultingInternational Security ConsultingDelator Global provides international security consulting to general counsel, CFOs, CISOs and compliance leaders who need practical advice on risks that cross borders.

Every Delator Global service

Countries

Where Delator Global Works

Delator Global handles matters in 152 countries, with a country page for each and a city page for every city over 200,000 people. Larger markets are listed below; the full list is on the international page.

• United Kingdom
• Canada
• Mexico
• Germany
• France
• India
• Brazil
• Australia
• Japan
• United Arab Emirates
• South Africa
• Nigeria
• China
• South Korea
• Spain
• Italy
• Netherlands
• Poland
• Turkey
• Philippines
• All 152 countries