Services
Penetration testing: finding the weak points before somebody else does
A simulated, authorised and agreed attack, to see how far someone could get inside your infrastructure. What you get at the end is not a list of alerts, but a list of things to fix, in order of importance.
What can be put to the test
We agree the scope together: it rarely makes sense to test everything at once
External perimeter
Everything of yours that can be seen from the internet: website, VPN, mail, published services, cloud tenants, devices exposed by mistake. This is where most attempts come through.
Internal network
What someone already inside can do: an infected laptop, a guest on the Wi-Fi, a disgruntled employee. We check whether one workstation leads to the servers and the data.
Web applications
Business systems, client portals, restricted areas, but also the APIs that connect them and the mobile apps that rely on them: authentication, permissions, injection, exposed data. Even when the software belongs to somebody else, the risk is yours.
Wi-Fi and access
Networks genuinely separated or only on paper, weak keys, a guest network that talks to the company one, devices nobody remembers connecting.
Simulated phishing
A fake but realistic campaign aimed at your people, agreed with management: how many open it, how many click, how many enter their credentials. No individual names in the report.
Vulnerability assessment
The systematic scan of the estate, repeatable over time. With us it is a continuous service in its own right: the scans are run by Rapid7 InsightVM and the results are analysed by the Barracuda SOC. It measures whether things are improving; a penetration test tells you how exploitable they are.
How it is carried out
With written rules, from the start to the final check
Scope and rules
We set out in writing what may be touched, what may not, in which time window and who must be informed. Without written authorisation we do not start: that is a legal requirement, not a formality.
Reconnaissance
We gather what is already public about you and map the services that can be reached, exactly as someone studying you would.
Controlled exploitation
The weaknesses found are genuinely tested, but under control: the aim is to demonstrate the impact, not to cause damage or halt production.
Report and retest
We hand over the report, talk it through, and after your fixes we re-check the points that were flagged.
What you are left with
The value of a test lies entirely in the report and in what you do with it afterwards
A summary for management
Two pages without jargon: how exposed you are, to what, and which three things to tackle first. Also useful to show a client or an insurer.
The technical detail
For each issue: where it is, how it was verified, what it leads to and how to fix it. With the evidence, so whoever has to fix it does not start from scratch.
A real order of priority
Issues ranked by the real risk in your context, not by a theoretical score: what must be closed today is kept separate from what can wait.
The check afterwards
A test is worth little if it stays in a drawer: after the fixes we re-check the points we flagged and tell you what is genuinely closed.
Why do it
Firewalls, antivirus and backups get installed and then everyone assumes they work. A penetration test exists precisely not to assume it: it puts the defences through what somebody genuinely trying would do, and almost always what surfaces is not exotic holes but things left open years ago and forgotten — a service published for a supplier who no longer works with you, a default password on a device, a permission granted too broadly “to save time”.
It also serves to prove it to those who ask: clients who place you in their supply chain, tenders that demand guarantees, cyber insurers who want to know how you verify yourselves. In those cases the report is the proof that security is not merely claimed.
Who actually runs the test
It is the first thing to ask anyone who offers you a penetration test
The test is carried out for us by a partner specialising in penetration testing: an organisation with around a hundred certified professionals who do this for a living every day. It is not something you improvise between two support calls, and we would rather say so than let you work it out.
We agree the scope and the rules with you, follow the work, talk you through the report in plain language and take care of the fixes on the infrastructure. You still deal with one supplier, and the things to fix do not end up in a document nobody picks up again.
The firm’s accreditations
The partner is accredited by CREST and NIS2: these are third-party audits of the way they work, not self-declarations. They matter when the report has to be shown to a client, a public body or an insurer.
Certifications of the people testing
Their team holds certifications OSCP, OSCE, OSWE and OSED from Offensive Security, CRT and CPSA from CREST, plus CEH, eCPTX, GCIH and CISSP. These are the letters that separate someone who can exploit a flaw from someone who can only list it.
We stay your point of contact
Scope, authorisations, time windows, walking through the report and fixing things: it all goes through us. You do not manage one more supplier, and whoever fixes it already knows your network.
Frequently asked questions
Let’s find out where the way in is
It always starts with a conversation about scope: what you have exposed, what worries you, what you have been asked to demonstrate.
