Home › Services › Penetration testing
Penetration testing services in Nairobi, Kenya
A penetration test demonstrates how an attacker could gain access to your systems, how far they could progress and which data would be exposed. APOPS Assurance conducts controlled tests that simulate real attacks, under your written authorisation, and delivers a prioritised remediation plan followed by verification of the fixes.
What we test
- External network: internet-facing servers, firewalls, VPNs, email and remote access
- Internal network: the systems reachable from your office LAN or Wi-Fi, including Active Directory
- Web applications and APIs: login, sessions, access control, injection, payment and M-Pesa callbacks
- Mobile apps (Android and iOS) and the servers behind them
- Wireless networks and guest Wi-Fi separation
- Cloud: Microsoft 365, Azure, AWS and Google Cloud configurations
- Social engineering and phishing simulations, when you ask for them
How a test runs
- Scope and rules of engagement agreed and signed before any testing
- Testing at agreed times, with a named contact on your side and an emergency stop
- Each finding manually validated and supported by evidence
- A report with a one-page summary for management and technical steps for your IT team
- Retesting of remediated findings, included in the engagement
Who needs one
Banks, SACCOs, insurers, hospitals, schools, NGOs and any business that holds customer or payment data. Regulators and clients increasingly require a recent independent test, and the Data Protection Act, 2019 requires organisations to regularly test and evaluate the effectiveness of the safeguards protecting personal data.
Why APOPS Assurance
- Established in Nairobi in 2016 as Angstrompal Ventures and incorporated as APOPS Assurance Ltd in 2026, serving organisations across Kenya
- IT audit, cybersecurity and compliance delivered by one team, so findings, remediation and monitoring stay connected
- Our team holds CISA, CISM, CISSP, CEH and ISO/IEC 27001 Lead Auditor certifications
- Clear written proposals, signed confidentiality agreements and a follow-up review after every engagement
Frequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A scan lists possible weaknesses automatically. A penetration test has a person confirm and exploit them safely, chaining small issues together, to show the real risk and remove false alarms.
Will testing disrupt our systems?
We agree timings and limits in advance, avoid destructive tests on live systems, and stop at once if anything behaves unexpectedly. Sensitive systems can be tested in a copy or out of hours.
How long does a penetration test take?
A small website or network takes a few days; a larger scope takes one to three weeks. You get the report within days of the end of testing.
How often should we test?
At least once a year, and after major changes such as a new system, a new website or moving to the cloud.
Do you sign a non-disclosure agreement?
Yes. Every engagement is covered by a signed NDA and rules of engagement, and findings are shared only with the people you name.
Talk to us
Call +254 722 102 317, email info@apopsassurance.com or visit us at Kimathi House, Kimathi Street, Nairobi.