Penetration testing
A penetration test is a controlled, authorised attack on your systems that shows what a real attacker could reach. We test your web applications, APIs, networks and cloud accounts, then explain every finding in plain English, with the evidence, the risk to your business and the fix, ranked so you know what to close first.
When to commission a penetration test
- A client, insurer or tender asks for a recent penetration test report.
- You are launching a new application, portal or API.
- You have moved systems to the cloud and want proof they are locked down.
- Your last test is more than a year old, or you have never had one.
What we test
Web applications
Authentication, session handling, access control between users, injection, file uploads and business-logic flaws, guided by the OWASP Top 10.
APIs
Whether one customer can reach another's data, how tokens are issued and checked, rate limits, and what each endpoint gives away.
External infrastructure
Everything you expose to the internet: servers, VPNs, remote access, email and forgotten services an attacker would find first.
Internal network
What an attacker could do from one compromised laptop: moving between systems, escalating privileges and reaching sensitive data.
Cloud configuration
Identity, storage, network rules and logging in Microsoft Azure and AWS, checked against secure baselines.
How a penetration test runs
- 01
Scope
We agree the targets, dates, testing windows and rules of engagement in writing, with a fixed price, before any testing starts.
- 02
Test
Manual testing by an engineer, backed by automated scanning. Anything critical is raised with you as soon as it is confirmed, not saved for the report.
- 03
Report
An executive summary your leadership can read, and technical detail with evidence, risk ratings and step-by-step fixes for your developers.
- 04
Fix and retest
We can help your team close the findings, then retest to confirm each one is fixed, so the report reflects where you actually stand.
What you receive
- A written scope and rules of engagement, agreed before testing
- An executive summary in plain English
- Every finding with evidence, risk rating and the steps to fix it
- A prioritised remediation plan
- A debrief call to walk through the results
Penetration testing: common questions
What is the difference between a penetration test and a vulnerability scan?
A scan is automated and lists possible weaknesses. A penetration test has an engineer try to exploit them and chain them together, which proves what is actually reachable and removes false alarms.
How much does a penetration test cost?
It depends on what is in scope: the number of applications, APIs, user roles and IP addresses. After a short scoping call you receive a written proposal with a fixed price before any work starts.
How often should we test?
At least once a year, and after significant changes such as a new application, a major release or a cloud migration. Many client contracts, and ISO 27001, expect regular testing.
Will testing disrupt our live systems?
Testing is planned with you, scoped in writing and scheduled to avoid disruption. Anything that could affect availability is agreed in advance or run against a test environment.
Does Cyber Essentials require a penetration test?
No. Cyber Essentials is a self-assessment, and Cyber Essentials Plus adds a technical audit by the certification body. A penetration test goes further than either, and is often what clients ask for alongside them.