Systematic Exploitation.
Actionable Intelligence.
Real-world attack simulation across your full attack surface — network, application, mobile, cloud, and human — conducted by certified specialists using the same techniques used by advanced threat actors.
We Test Every Attack Surface
We do not offer a single generic penetration test. Each engagement is scoped to the specific attack surfaces that are relevant to your organisation and threat model, delivered by specialists in that domain.
Network Penetration Testing
Internal and external network testing to identify exploitable vulnerabilities across your infrastructure — perimeter, internal segmentation, domain controls, and remote access capabilities. We operate from both an external unauthenticated perspective and a compromised internal host position.
What We Cover
- External perimeter: internet-facing hosts, services, and exposed attack surface
- Internal network: Active Directory, lateral movement paths, privilege escalation
- Network segmentation validation between critical zones
- Remote access: VPN, RDP, Citrix, and jump server security
- Wireless network security assessment (on-site engagement)
- Firewall rule review and egress filtering validation
Methodology
We follow the Penetration Testing Execution Standard (PTES) supplemented by industry-specific requirements. All testing is conducted under a signed rules of engagement document.
Deliverables
- Executive summary with risk-rated findings
- Full technical report with reproduction steps
- Proof-of-concept evidence for all critical and high findings
- Remediation roadmap with prioritised actions
- Free retest within 90 days of report delivery
Web Application Penetration Testing
Comprehensive assessment of web applications against the OWASP Top 10 and beyond. We test both the application layer and its underlying infrastructure, covering authentication, authorisation, business logic, API endpoints, and third-party integrations.
What We Cover
- OWASP Top 10 and OWASP WSTG comprehensive coverage
- Authentication and session management weaknesses
- Authorisation flaws: IDOR, BOLA, privilege escalation
- Injection vulnerabilities: SQL, NoSQL, command, LDAP, template injection
- REST and GraphQL API security testing
- Business logic flaws specific to your application's workflows
- Client-side: XSS, CSRF, DOM-based vulnerabilities
- Third-party component and dependency analysis
Testing Approach
Deliverables
- Executive summary with CVSS-scored findings
- Full technical report with reproduction steps and code references
- Screen-recorded proof-of-concept for all critical findings
- Developer-friendly remediation guidance with code examples
- Free retest within 90 days of report delivery
Mobile Application Penetration Testing
Security assessment of iOS and Android applications against the OWASP Mobile Application Security Verification Standard (MASVS). We test the application binary, its communication channels, data storage behaviour, and backend API interactions.
What We Cover
- Static analysis: binary decompilation, hardcoded secrets, insecure code patterns
- Dynamic analysis: runtime behaviour, traffic interception, hooking and instrumentation
- Data storage: insecure local storage, unprotected SQLite databases, keychain misuse
- Network communication: certificate pinning, TLS configuration, API endpoint security
- Authentication and authorisation: token handling, biometric bypass, session management
- Reverse engineering resistance and anti-tampering controls
- Backend API testing aligned to the mobile application's functionality
Platform Coverage
Deliverables
- OWASP MASVS and MSTG aligned report
- Finding evidence including screenshots, traffic captures, and decompiled code
- Developer remediation guidance specific to your platform and framework
- Free retest within 90 days
Cloud Penetration Testing
Assessment of your cloud environment's configuration, identity controls, network posture, and workload security. We test cloud-native attack paths including IAM privilege escalation, metadata service abuse, and cross-account trust exploitation.
What We Cover
- IAM configuration review: overpermissive roles, privilege escalation paths, cross-account trust
- Storage security: S3 / Blob / GCS misconfiguration, public exposure, encryption posture
- Network configuration: security groups, NACLs, peering, exposed services
- Compute security: EC2/VM metadata service abuse, user data exposure, instance profiles
- Serverless: Lambda / Function App / Cloud Function permissions and injection
- Container and Kubernetes security: cluster RBAC, pod security, image vulnerabilities
- Secrets management: exposed credentials in code, environment variables, parameter store
Platform Coverage
Social Engineering Assessment
People are the most consistently exploited attack vector in enterprise environments. Our social engineering assessments measure the susceptibility of your workforce to phishing, vishing, and physical intrusion techniques — and provide targeted security awareness improvements.
What We Cover
- Phishing simulations: targeted spear-phishing campaigns against defined user groups
- Vishing: telephone-based pretexting to extract credentials or sensitive information
- Smishing: SMS-based attack simulation
- Physical intrusion: tailgating, badge cloning, dumpster diving (scope-dependent)
- Pretexting scenarios designed around your specific sector and business context
- Post-campaign awareness training recommendations and materials
Engagement Approach
All social engineering engagements are conducted under strict ethical guidelines and with written executive authorisation. We do not target individuals punitively — our objective is to measure organisational susceptibility and improve it.
Frameworks We Work Within
Our testing methodology draws from the leading international standards, adapted to the specific scope and risk profile of each engagement. We do not apply generic checklists — we tailor our approach to your environment and objectives.
PTES
The Penetration Testing Execution Standard defines a structured approach across seven phases: pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, and reporting.
PTES provides the operational backbone for our network and infrastructure engagements, ensuring consistency and comprehensiveness regardless of the tester assigned to your engagement.
OWASP
The Open Web Application Security Project provides the definitive framework for web application and API security testing. We apply the OWASP Web Security Testing Guide (WSTG) and OWASP MASVS for mobile assessments.
Our web application testers maintain OWASP chapter contributions and validate their techniques against the latest WSTG version. Findings are mapped to OWASP Top 10 categories for direct compliance alignment.
NIST SP 800-115
The NIST Technical Guide to Information Security Testing and Assessment provides the policy and process framework within which penetration testing activities are planned, scoped, and governed. Particularly relevant for US federal and regulated environments.
NIST 800-115 alignment ensures your penetration testing programme satisfies audit and compliance requirements and integrates correctly with your broader information security management system.
Deliverables Designed for Action
Our reports are written to drive remediation — not to satisfy a compliance checkbox. Every deliverable is designed to be immediately actionable by both technical teams and executive stakeholders.
Executive Summary
A non-technical narrative of the engagement, findings risk rating, and strategic remediation priorities. Suitable for board presentation and audit submission. Includes an overall risk posture assessment and comparison against industry benchmarks where applicable.
Full Technical Report
Detailed documentation of every finding including: description, CVSS score, affected asset, reproduction steps, technical impact, and business impact. Written for the engineers and architects responsible for remediation, with sufficient detail to reproduce and verify every issue.
Proof-of-Concept Evidence
Every critical and high severity finding is accompanied by reproducible proof-of-concept evidence: screenshots, screen recordings, HTTP request/response captures, code samples, or command output. Evidence is provided in a format that allows your team to validate the issue independently.
Remediation Roadmap
A prioritised action plan that sequences remediation based on exploitability, impact, and effort. Groups findings into immediate actions, short-term improvements, and strategic programme changes. Includes realistic effort estimates and suggested ownership assignment by team or function.
Retest Included
A free retest of all remediated findings is included within 90 days of the original report delivery. Retest results are documented in a formal closure report that confirms remediation effectiveness and can be submitted to auditors, regulators, or customers as evidence of remediation.
Live Debrief Session
Every engagement concludes with a structured debrief attended by the testing team and your technical and leadership stakeholders. We walk through the attack paths, demonstrate key findings, and answer questions in real time. Separate executive and technical debrief tracks available.
The Six-Step Test Lifecycle
Every penetration test follows a rigorous six-step lifecycle from initial scoping through to formal closure. No step is abbreviated and no phase begins until the previous one is complete and agreed.
Scoping & Rules of Engagement
A senior consultant conducts a structured scoping call to define the attack surface, objectives, testing windows, excluded systems, and emergency contact procedures. All parameters are codified in a formal Statement of Work and Rules of Engagement document signed by both parties before any testing commences.
Reconnaissance
Passive and active information gathering to understand the target's attack surface, exposed services, technology stack, employee structure, and publicly available intelligence. Reconnaissance findings frequently surface issues before a single exploit is attempted.
Vulnerability Analysis
Systematic identification of exploitable weaknesses through authenticated and unauthenticated scanning, manual testing, and service-specific enumeration. Every potential vulnerability is validated manually — we do not report scanner output without confirmation of exploitability.
Exploitation
Controlled, safe exploitation of confirmed vulnerabilities to demonstrate real-world impact. We operate within agreed safety parameters — avoiding actions that could cause service disruption, data loss, or collateral damage to systems outside the defined scope. Critical findings are disclosed to your team immediately upon confirmation, without waiting for the final report.
Reporting
The full deliverable package — executive summary, technical report, proof-of-concept evidence, and remediation roadmap — is delivered within the agreed timeframe. Draft reports are shared for factual review before finalisation. A live debrief session is scheduled within five business days of report delivery.
Retest & Closure
Once remediation is complete, we retest all addressed findings and issue a formal closure report. The closure report confirms remediation effectiveness for each finding and is suitable for submission to auditors, regulators, customers, or insurers as evidence of remediation.
Common Questions About Penetration Testing
A vulnerability scan is an automated, non-exploitative check that identifies potential weaknesses based on signatures and configuration checks. It produces a list of findings that may or may not be exploitable in your specific environment. A penetration test is conducted by human specialists who validate vulnerabilities, chain them together to demonstrate real attack paths, and determine the actual business impact of a successful exploitation. Penetration tests identify issues that scanners cannot, including business logic flaws, authorisation gaps, and complex multi-step attack chains. We recommend vulnerability scanning as a continuous baseline activity and penetration testing as a periodic, deeper assessment.
The appropriate frequency depends on your regulatory obligations, the pace of change in your environment, and your risk appetite. As a baseline, annual penetration testing is the minimum standard expected by most regulatory frameworks (PCI DSS, ISO 27001, SOC 2). In practice, we recommend testing after any significant infrastructure or application change, following a security incident, before launching new products or services, and when entering new regulated markets. Organisations with mature security programmes often move to a continuous or quarterly testing cadence using a security retainer, which also provides better value than individual project engagements.
We take extraordinary care to avoid service disruption during testing. All exploitation techniques are assessed for their potential to cause instability before use, and we operate within agreed testing windows — typically outside peak business hours for critical systems. Denial-of-service testing is never included without explicit written authorisation and pre-agreed conditions. Despite these precautions, no penetration test against a production environment carries zero risk of disruption, and we discuss this in the scoping session. For systems where availability risk is unacceptable, we recommend testing against a production-identical staging environment.
We require a signed Statement of Work and Rules of Engagement, a defined scope (IP ranges, domains, application URLs, or cloud account identifiers), a named technical contact for the duration of the test, and a documented escalation path for critical findings. For grey-box and white-box engagements, we will also require test accounts at defined privilege levels, architecture documentation, and any relevant network diagrams. For cloud assessments, we require read-only or limited IAM access configured to a specification we provide — we never ask for root or global administrator credentials. We provide a pre-engagement checklist to make this process straightforward.
Any sensitive data encountered during testing — credentials, personal data, financial records, intellectual property — is handled under strict data minimisation principles. We document the existence and nature of accessible data as evidence of the vulnerability but do not exfiltrate, retain, or process the underlying data beyond what is necessary to prove access. All evidence is stored encrypted and transmitted securely. At engagement close, all client data in our possession is securely deleted and confirmed in writing. Our data handling procedures are detailed in our Data Processing Agreement, available on request.
Ready to Test Your Defences?
Speak with a senior penetration tester to define the right scope for your environment. We provide a fixed-fee proposal within two business days of the scoping call.