Z-node

Our workstation. Your network.

An internal pentest needs someone inside your network. With a Z-node, that someone does not have to be on site. We send a mini PC, you plug in power and network, and we test from our office. Evenings and weekends too, so heavy scans stay out of your way.

Request a Z-node See pentesting
Z-node // Mini PC // Encrypted storage // Outbound VPN // 4G failover

Secured layer by layer

We build, deliver and manage the Z-node ourselves, and treat it as if it will be stolen tomorrow.

Secured layer by layer

We build, deliver and manage the Z-node ourselves, and treat it as if it will be stolen tomorrow.

01 System

Only what is needed

Secure boot and locked firmware. Services and ports we do not need are switched off.

02 Workstation

All tooling on board

Scans run on the node and the results stay there. You do not need to arrange accounts, licences or workstations.

03 Storage

Fully encrypted

Without our key the node is useless, even if it goes missing in transit.

04 Connectivity

Outbound only

The node sets up an encrypted VPN connection to us itself. No port is open to the inside.

05 Data

Nothing goes to third parties

Findings stay on the node or inside our own VPN network. Nothing goes to anyone else’s storage or services.

01 / 05 Scroll to take it apart

How an engagement runs

On your side it is two cables and one firewall rule.

  1. Step 01

    We set it up

    A clean install and keys that are valid for your engagement only. We ship it or bring it over.

  2. Step 02

    You plug it in

    Power and network, on the segment we are testing. The node then checks in with us by itself.

  3. Step 03

    One outbound UDP port

    That is all we ask of your network team. No inbound rules and no port forwarding.

  4. Step 04 4G

    No port? Then 4G as a fallback

    Your network is much faster, so that is always our first choice. If the port really cannot be opened, the node falls back to its 4G modem so the test can still go ahead.

  5. Step 05

    We test

    Our pentesters work when it suits you, outside office hours included.

  6. Step 06

    Back in the box

    Unplug it and send it back. We wipe the node and revoke the keys.

What it gets you

No travel time, no visitor procedure and no guest accounts.

No calendar juggling

We work remotely. Nobody has to free up a desk or escort a visitor.

Scan when it is quiet

We schedule heavy scans at night, at the weekend or in your maintenance window.

Extra specialist, same node

A colleague joining in logs in to the same node. No extra hardware or accounts.

You stay in control

One device with one outbound connection. Pull the plug and we are gone.

Who does what

01 // You arrange
  • A network port on the segment we are testing
  • Power and a place for the node
  • One outbound UDP port in the firewall
  • Sending the node back afterwards
02 // We arrange
  • Hardware, security and management of the node
  • The encrypted VPN connection
  • Tooling, testing and reporting
  • Wiping the node and revoking the keys
See pentesting →

Frequently asked questions

Do we have to expose anything to the internet?

No. The node accepts no inbound connections and sets up an outbound VPN connection to us itself.

What if our firewall does not allow outbound UDP?

Then the node falls back to 4G. That is slower than your own network, so we first check with you whether that one port can be opened after all.

Where does our data sit during the test?

On the encrypted node or inside our own VPN network. Afterwards we wipe the node.

Can the node cover several parts of our network?

Yes. We move the node or place several, each with its own connection and keys.

A Z-node in your network?

Tell us what you want tested. Together we decide where the node goes and what your firewall team needs to arrange.

Get in touch