Stay secure · Penetration testing
Find the gaps before an attacker does.
CREST-certified testers in our own UK team test your networks, applications, cloud and people, then tell you in plain English what to fix first.
- CREST-certified testers
- In-house UK team, never subcontracted
- Most tests take 2 to 10 working days
- Fixed-price proposals
What you get
Know your real risk
Manual testing that chains weaknesses together the way attackers do, not just an automated scan.
Fix what matters first
A risk-based report with an executive summary for the board and clear remediation steps for your team.
Evidence for auditors
Outputs that support ISO 27001, Cyber Essentials, PCI DSS and SOC 2, with an optional retest to prove fixes.
What is included
- External perimeter testing
- Internal network testing
- Web application testing
- Cloud testing across Azure, AWS and hybrid environments
- Mobile app testing (iOS and Android)
- Social engineering: phishing, vishing and physical testing
- Risk-based report with executive summary
- Remediation consultation and optional retest
Who it is for
Organisations that need assurance or compliance evidence, including firms preparing for ISO 27001, Cyber Essentials Plus, PCI DSS or a client security review.
How it works
- 1
Scope
We agree the test plan, schedule and a fixed price.
- 2
Test
Real-world attack simulation with manual validation of every finding.
- 3
Report
Prioritised findings, an executive summary and support for your auditors.
- 4
Retest
Optional retesting to confirm fixes and give you evidence they worked.
Independently verified, continuously.
ISO 27001 certified since 2016, Cyber Essentials Plus, CREST-certified testers and an Assurix Trusted MSP.
See how we are verifiedQuestions we are often asked
How long does a penetration test take?
Most tests take between 2 and 10 working days, depending on scope. You receive a fixed-price proposal with the schedule before work starts.
How often should we have a penetration test?
At least once a year, and after any significant change such as a new application, a cloud migration or a major network change.
Do you subcontract testing?
No. All testing is carried out by our own CREST-certified team in the UK.
Is Cyber Essentials Plus the same as a penetration test?
No. Cyber Essentials Plus is a technical audit that checks a defined set of controls. A penetration test goes much further, actively trying to exploit weaknesses the way a real attacker would.
What is the difference between internal and external testing?
External testing targets what is visible from the internet, such as websites, VPNs and remote access. Internal testing assumes an attacker is already inside, for example through a phishing email, and shows how far they could get.
Is a penetration test the same as a vulnerability scan?
No. A vulnerability scan is automated and lists known weaknesses. A penetration test uses manual techniques to exploit and chain weaknesses together, showing what an attacker could actually do.
Does ISO 27001 require a penetration test?
The standard does not require one by name, but you must manage technical vulnerabilities and show your controls work. A penetration test is one of the clearest ways to evidence that for your auditor.
How much does a penetration test cost?
It depends on the scope. After scoping we send a fixed-price proposal, so you know the cost before any testing starts.
Often paired with
Talk to us.
A short, no-obligation conversation about what this would look like for your organisation.