# Raxis

> Manual penetration testing by senior U.S. engineers since 2011. Raxis Strike is the point-in-time penetration test; Raxis Attack is continuous penetration testing as a service (PTaaS). Every test is human-led: a senior engineer does the testing and writes every finding, and AI is a tool the engineer drives.

Raxis is a penetration testing and red team firm based in Atlanta, Georgia, founded in 2011. Its engineers are senior, U.S.-based, hold certifications such as the OSCP, OSCE, OSWE, OSEP, CISSP and GPEN, and have published CVEs in enterprise software. Findings are delivered through the Raxis One platform with proof-of-concept evidence, and retesting is included. Raxis holds a SOC 2 Type II examination. Contact: hello@raxis.com, 678.421.4544.

## Penetration Testing Services

- [Manual Penetration Testing Services](https://raxis.com/pentest/): Our penetration testing methodology follows MITRE ATT&CK and NIST 800-115: scoping, reconnaissance, exploitation, reporting in Raxis One, and retesting.
- [Point-in-Time Penetration Testing | Raxis Strike](https://raxis.com/pentest/point-in-time/): Raxis Strike is a deep, human-led point-in-time penetration test: manual exploitation, business-logic and human-element attacks, and a report you can act on.
- [Penetration Testing as a Service (PTaaS) | Raxis Attack](https://raxis.com/pentest/ptaas/): Raxis Attack PTaaS delivers unlimited manual penetration testing year-round. Real-time findings in Raxis One, Jira integration, and retesting built in.
- [Active Directory Penetration Testing](https://raxis.com/pentest/active-directory/): Active Directory penetration testing that shows how one domain user becomes domain admin: Kerberoasting, delegation abuse, Entra ID, and hybrid paths.
- [AI & LLM Penetration Testing Services](https://raxis.com/pentest/ai/): Find out what your AI can expose or do. Raxis tests assistants, RAG applications, and agents for unauthorized access, prompt injection, and tool abuse.
- [API Penetration Testing Services](https://raxis.com/pentest/api/): Manual API penetration testing services for REST, GraphQL, SOAP, and gRPC. We exploit the BOLA, business logic, and auth flaws automated scanners miss.
- [Cloud Penetration Testing Services (AWS, Azure, GCP)](https://raxis.com/pentest/cloud/): Cloud penetration testing that finds the IAM, storage, and identity misconfigurations that turn one leaked key into account takeover. AWS, Azure, GCP.
- [External Network Penetration Testing Services](https://raxis.com/pentest/external-network/): External penetration testing that finds and exploits real vulnerabilities in your internet-facing systems. Human-led, PCI and SOC 2 ready, retest included.
- [Internal Network Penetration Testing](https://raxis.com/pentest/internal-network/): Internal penetration testing shows what an attacker does once inside: Active Directory, lateral movement, and segmentation, by senior U.S. engineers.
- [IoT Penetration Testing](https://raxis.com/pentest/iot/): Raxis IoT penetration testing goes beyond the network. Our engineers test hardware, firmware, wireless protocols, and APIs.
- [Mobile Application Penetration Testing](https://raxis.com/pentest/mobileapp/): Protect your mobile apps with Raxis’ expert penetration testing. Uncover vulnerabilities, secure user data, & prevent breaches on iOS and Android platforms.
- [OT Penetration Testing Services](https://raxis.com/pentest/ot/): Raxis OT penetration testing safely identifies vulnerabilities across SCADA, ICS, and industrial networks. Availability-first methodology.
- [Remote Penetration Testing](https://raxis.com/pentest/remote/): Raxis Transporter delivers remote penetration testing for internal, wireless, and cloud environments. Same coverage as onsite, without the travel or delays.
- [Salesforce Penetration Testing](https://raxis.com/pentest/salesforce/): Salesforce penetration testing for PCI DSS and HIPAA compliance. Expert testing of Apex code, Communities, Guest Users, APIs, and permission sets.
- [Thick Client Application Penetration Testing](https://raxis.com/pentest/thick-client/): Raxis thick client penetration testing reverse-engineers desktop applications to find local storage, memory, and backend flaws that web and network tests miss.
- [Web Application Penetration Testing](https://raxis.com/pentest/webapp/): Manual web application penetration testing that finds business logic flaws, broken access control, and exploitable chains automated scanners miss.
- [Wireless Penetration Testing](https://raxis.com/pentest/wireless/): A Raxis wireless penetration test uses several techniques to leverage your wireless network with a goal of reaching the internal network and critical systems.

## Red Team Services

- [Red Team Services & Adversary Simulation](https://raxis.com/red-team/): Raxis Red Team engagements operate like real adversaries: phishing, physical intrusion, and stealth network attacks to test whether your team detects them.
- [Breach & Attack Simulation Services](https://raxis.com/red-team/breach-and-attack-simulation/): Human-led breach and attack simulation beyond automated tools. Real penetration testers validate your defenses with AI-augmented testing.
- [Phishing, Spear Phishing, Vishing Services](https://raxis.com/red-team/phishing/): Enhance your cybersecurity defenses with Raxis' custom methods, including phishing penetration testing and vishing testing to reveal real risks.
- [Physical Penetration Testing & Social Engineering](https://raxis.com/red-team/physical-social-engineering/): Raxis physical penetration testing simulates real facility breaches: badge cloning, lock bypass, tailgating, and pretexting by US-based Red Team engineers.

## Cybersecurity Services and Platform

- [Cybersecurity Services: IR, Purple Team & Tabletops](https://raxis.com/cybersecurity-services/): Incident response, purple team, tabletop exercises, and security assessments from the U.S. engineers who run our penetration tests.
- [Attack Surface Management Services](https://raxis.com/attack-surface-management/): Expert-led attack surface management that discovers unknown assets from an attacker's perspective. AI-augmented ASM with penetration testing expertise.
- [Secure Code Review Services](https://raxis.com/cybersecurity-code-review/): Expert secure code review combining penetration testing expertise with AI. Find vulnerabilities before attackers do. PCI, HIPAA, and SOC 2 ready.
- [Raxis One: Penetration Testing Platform](https://raxis.com/raxisone/): Follow your Raxis pentest from scope to verified fixes. See live findings, talk to your testers, connect Jira and developer tools, and access reports in Raxis One.

## Industries

- [Penetration Testing by Industry](https://raxis.com/industry/): Industry-specific penetration testing from Raxis. Scoped to the threats, compliance frameworks, and systems that define your sector.
- [Blockchain & Cryptocurrency Penetration Testing](https://raxis.com/industry/blockchain-crypto/): Penetration testing for blockchain platforms, crypto exchanges, DeFi protocols, and smart contracts. Raxis finds the flaws that lead to fund loss first.
- [Education Penetration Testing Services](https://raxis.com/industry/education/): Penetration testing built for schools and universities. Raxis secures student data, campus networks, LMS platforms, and research systems.
- [Energy Penetration Testing](https://raxis.com/industry/energy/): Energy and critical infrastructure penetration testing by senior engineers: vendor access, IT/OT boundaries, SCADA and ICS, tested by hand within limits you set.
- [Financial Services & Bank Penetration Testing](https://raxis.com/industry/financial-banking/): Penetration testing for banks, credit unions, and financial services, by hand by senior engineers. Evidence mapped to GLBA, FFIEC, NYDFS Part 500, NCUA, and PCI DSS.
- [Government Penetration Testing](https://raxis.com/industry/government/): Penetration testing for government agencies and contractors, aligned to NIST 800-171, CMMC, DFARS, and FISMA to protect CUI and critical systems.
- [Healthcare Penetration Testing](https://raxis.com/industry/healthcare/): Raxis delivers human-led healthcare penetration testing of EHR systems, medical devices, telemedicine platforms, and clinical networks for HIPAA, FDA.
- [Manufacturing Penetration Testing Services](https://raxis.com/industry/manufacturing/): Penetration testing built for manufacturers. Raxis tests IT and OT together to find the cross-domain attack paths that stop production and expose IP.
- [Media & Entertainment Penetration Testing](https://raxis.com/industry/media-and-entertainment/): Penetration testing for studios, media companies, and streaming platforms. Raxis secures production pipelines, content delivery, and unreleased assets.
- [SaaS & Software Penetration Testing](https://raxis.com/industry/software-development/): Penetration testing for software companies that goes beyond OWASP scans: applications, APIs, CI/CD pipelines, cloud, and multi-tenant isolation.
- [Social Media Platform Penetration Testing](https://raxis.com/industry/social-media/): Penetration testing for social media platforms. Raxis secures user data, privacy, and engagement systems against account takeover and data exposure.
- [Telecom Penetration Testing](https://raxis.com/industry/telecom/): Telecom penetration testing by certified human testers: network infrastructure, VoIP, and APIs, aligned with FCC, ISO 27001, and PCI DSS.
- [Transportation Penetration Testing](https://raxis.com/industry/transportation/): Raxis penetration testing for transportation: ground, air, maritime, and rail systems tested by certified human testers aligned with TSA, NIST, and ISO 27001.
- [Water Utility Penetration Testing](https://raxis.com/industry/water/): Raxis penetration testing for water and wastewater utilities: SCADA, ICS, OT, and IT systems tested by certified human testers aligned with EPA, AWIA, and NIST.

## Compliance

- [Compliance Penetration Testing Services](https://raxis.com/compliance/): Meet PCI DSS, SOC 2, HIPAA, GLBA, ISO 27001, and more with manual penetration testing from senior U.S. engineers. Auditor-ready reports and attestation letters.
- [GLBA Safeguards Rule Penetration Testing](https://raxis.com/compliance/glba/): Raxis delivers expert-led GLBA penetration testing services of systems handling customer NPI for banks, lenders, insurers, and financial services.
- [HIPAA Penetration Testing](https://raxis.com/compliance/hipaa/): Expert-led HIPAA penetration testing mapped to the Security Rule, proving your safeguards protect ePHI, with auditor-ready reports.
- [ISO 27001 Penetration Testing](https://raxis.com/compliance/iso-27001/): Penetration testing that proves your ISMS controls work under real attack, not just that they exist on paper
- [PCI Penetration Testing Services (DSS v4.0.1)](https://raxis.com/compliance/pci/): Human-led PCI DSS v4.0.1 penetration testing. We validate CDE segmentation, payment apps, and APIs, then deliver QSA-ready proof and retesting.
- [SOC 2 Penetration Testing](https://raxis.com/compliance/soc2/): Raxis delivers expert-led SOC 2 penetration testing mapped to Trust Services Criteria that finds real vulnerabilities in your SaaS environment.

## Company

- [The People Behind the Pentest](https://raxis.com/company/): Meet Raxis, the Atlanta-founded, U.S.-based team behind human-led penetration testing and red team services. Senior engineers. Documented proof. Clear next steps.
- [Apply to Work at Raxis](https://raxis.com/company/apply/): Apply to work with some of the brightest minds in cybersecurity. Raxis is looking for OSCP-certified U.S. citizens for senior-level penetration testing roles.
- [Careers at Raxis](https://raxis.com/company/careers/): Bring your curiosity and proven skills to Raxis. Explore penetration testing and sales roles, meet the team, and learn what to expect when you apply.
- [Penetration Testing Certifications](https://raxis.com/company/certifications/): Our professionals strive to keep their skills polished to make certain they stay ahead of the latest threats. Certifications and training show that commitment.
- [Trust Center](https://raxis.com/company/trust/): Raxis holds itself to the same security standards we help clients test. This Trust Center summarizes our SOC 2 examination, insurance coverage, secure
- [Penetration Testing Partner Program](https://raxis.com/partner/): Keep your client relationships. Add senior-led Raxis penetration testing, co-branded reports, 20–30% partner margins, and recurring PTaaS to your portfolio.
- [Security Research and Discovered CVEs](https://raxis.com/security-research/): Raxis engineers have discovered 12 CVEs across ManageEngine, PRTG Network Monitor, Nagios XI, and Rock RMS, disclosed responsibly through MITRE.
- [Request a Sample Report](https://raxis.com/sample-report/): Evaluate a Raxis penetration test report before you commit. See proof-of-concept exploits, attack paths, and remediation guidance. Samples arrive within one business day.
- [Contact Raxis](https://raxis.com/contact/): Contact Raxis for penetration testing by senior U.S. engineers who test by hand. Tell us what you need tested and we reply within one business day.

## Learn

- [What is Penetration Testing?](https://raxis.com/pentest/what-is-a-penetration-test/): Learn what penetration testing is, how it works, and why it matters, explained by certified ethical hackers who perform real-world pentests every day.
- [AI vs Human Pentesting: Why Human-Led Testing Wins](https://raxis.com/pentest/ai-vs-human-pentest/): Why human-led penetration testing beats AI-only tools: Raxis engineers use AI to move faster, then do the testing, judge the results, and write the findings.
- [Penetration Testing Glossary](https://raxis.com/pentest/glossary/): Every term in your pentest report, defined in plain English by the engineers who wrote it. From attack chain to zero-day, no security degree required.
- [About Those “Top 10 Pentesting Companies” Listicles](https://raxis.com/pentest/top-10-pentesting/): The self-promotional “best penetration testing companies” listicle is collapsing. How to actually vet a pentest firm: CVEs, analyst coverage, verified reviews.
- [Top 10 Cyber Attacks of 2025](https://raxis.com/topten25/): Raxis has released our highly anticipated “Top 10 Cyber Attacks of 2025” report. This comprehensive document provides valuable insights into the most

## Blog

- [The Exploit](https://raxis.com/blog/): Penetration testing insights from Raxis engineers: research, tooling, discovered vulnerabilities, and how-to articles.
- [RSS feed](https://raxis.com/feed.xml): The blog as RSS.

## Optional

- [Sitemap](https://raxis.com/sitemap_index.xml): Every indexable page and post.
- [Privacy Policy](https://raxis.com/privacy-policy/): How Raxis handles personal data and cookies.