Services · Test
Penetration testing
We test your applications, networks and cloud environments the way an attacker would, inside a written scope and rules of engagement you sign, and report every finding with its evidence and its fix.
What it covers
- Web applications and their APIs
- Authentication, authorisation and session handling
- Your external network perimeter
- Internal networks, from a starting point we agree with you
- Cloud accounts and their configuration
- A retest of the findings you fix
How an engagement runs
Scope
We agree targets, exclusions, testing windows, permitted techniques and emergency contacts, and confirm who has the authority to approve the test.
Authorise
Testing does not start until written authorisation and signed rules of engagement are in place, along with any permission a third-party provider requires.
Test
We test only the agreed targets within the agreed windows. Critical findings go to your named contact during testing rather than waiting for the report.
Report
You receive a written report with every finding, its evidence and how to fix it.
Debrief and retest
We walk your team through the findings, then retest the ones you fix within the agreed window.
What you receive
- An executive summary written for non-specialists
- Each finding with its severity, affected asset, evidence, steps to reproduce and remediation guidance
- A statement of scope and method, including what was not tested
- A debrief call with your team
- A retest of fixed findings within the agreed window, with the results in writing
Talk to us about penetration testing.
Tell us what you want tested and who owns it. We will start with scope and authorisation before anything else.