A review of controls, policies and configuration, not a simulated attack.
A pentest tries to get in. An audit assesses whether the controls, the rules and the configuration are what the organization needs. The report says what is missing and where to fix it, against the standard the client has to meet, such as ISO 27001 or PCI-DSS.
Network, identity, data protection and cloud configuration.
Written rules, incident response, continuity and people training.
What the company has to protect, what threatens it, and what to treat first.
The review measures the controls against the requested standard, with the gaps and the path to close them.
PT
EN