Penetration testing & security assessments
Preparing an application launch, a customer security review or a change to your infrastructure? Define an authorised penetration test and receive evidence, remediation priorities and an agreed retest scope.
Scope, deliverables and fees agreed before work begins.
Your priority
A release, customer requirement or security concern.
The assessment
Authorised targets, rules of engagement and verified findings.
Your deliverables
Technical evidence, an executive summary and remediation priorities.
Test the systems your business depends on
A vulnerability scan is a useful starting point, but it does not explain every way weaknesses can combine. We assess internet-facing assets, internal networks, web applications, APIs, and configurations within an agreed scope. Where appropriate, source code and architecture reviews help identify issues that are difficult to observe from outside.
Before testing begins, we agree on authorisation, systems in scope, testing windows, exclusions, and escalation contacts. This makes the assessment practical for production environments and gives your team a clear view of what will happen.
Turn findings into a remediation plan
We validate findings, explain their impact, and organise them by risk. Your technical team receives evidence and practical recommendations, while decision-makers receive a summary of exposure and priorities. Retesting can then confirm whether the agreed fixes address the original issues.
An assessment is particularly useful before a launch, after a significant infrastructure change, or when a customer asks for independent assurance. The scope should reflect the business process being protected, not simply the number of hosts.
Web application and API penetration testing
A customer portal, booking platform or partner API needs testing of how people actually use it. We define user roles, sensitive records and important transactions, then examine whether access boundaries and business rules hold. Scope can include account recovery, session handling, file exchange and integrations. Test accounts and representative workflows help distinguish a technical weakness from an exploitable business risk.
External, internal and cloud security assessments
An external assessment examines the agreed internet-facing estate. Internal testing considers what an authorised test position could reach inside the network, while a cloud review examines the selected identities, configuration and service boundaries. These are different starting points. We recommend a scope that answers your priority question, including dependencies on hosting providers and managed services, instead of treating every environment as one generic scan.
Prepare for a launch, customer review or major change
Typical triggers include a new application release, a significant infrastructure change or a customer asking for independent security evidence. Before quoting, we establish the number of applications, user roles, environments, interfaces and reporting needs. Testing windows, excluded systems, stop conditions and escalation contacts are recorded in the rules of engagement. Sensitive live workflows can require a controlled test environment or additional safeguards.
Use retesting to close the remediation loop
Each finding should help its owner reproduce the issue safely, understand the affected business process and decide what to fix. An agreed retest checks the identified issue against the implemented change and records any remaining limitation. A closure summary can support management review or a customer discussion, while keeping detailed exploit information restricted to appropriate recipients.
What you receive
- Agreed scope and rules of engagement
- Validated findings with evidence and risk context
- Technical remediation guidance and executive summary
- Retesting scope and improvement priorities
- Application, role and attack-surface scope with agreed testing boundaries
- Retest status for the findings included in the follow-up scope
Common questions
Will testing disrupt our operations?
Testing methods and windows are agreed in advance. We discuss sensitive systems and operational constraints, and define a contact and stop procedure before any active testing.
Is a penetration test the same as a vulnerability scan?
No. Scanning identifies potential issues at scale. A penetration test validates selected weaknesses and examines their practical impact within the authorised scope.
What determines the cost of a penetration test?
Scope and complexity matter more than a simple count of IP addresses. Applications, roles, business workflows, environments, testing restrictions and reporting or retest requirements all affect the effort. We define these before proposing a fixed engagement.
Can you test a system hosted by another provider?
Testing requires permission covering the systems and methods in scope, including relevant provider conditions. We establish ownership, responsibilities and any separate approvals before work begins.
Further reading: OWASP Web Security Testing Guide
Plan the next step
Compare scope, cost and reportingInvestors & portfolio companiesStartups & technology companiesRelated established services
IT security consulting and risk assessmentInformation security services for your businessConnected expertise
All services
Security operations & MDR
Bring security signals together, investigate suspicious activity, and define a response process your team can act on.
Explore service
Governance & compliance
Connect risk management, GDPR, NIS2, DORA, and ISO 27001 preparation with practical CISO and DPO support.
Explore service
Identity & executive security
Strengthen access controls, secure communications, and digital protection for organisations and executives.
Explore serviceA clear next step
Start with your question.
You do not need a technical specification to contact us. Describe the need and we will help define the right scope.
- Send a brief description and any deadline.
- We clarify scope, access and confidentiality.
- Receive a proposal with deliverables, timing and fees before work begins.
For an active security incident, call the team. Agree a secure channel before sharing evidence or sensitive information.