Home / Penetration testing
Scoped, point-in-time engagements against a defined target. Most clients start here, and many then move the external estate onto continuous coverage once the report is delivered.
We scope the target with you, agree the rules of engagement in writing, and verify you are entitled to authorise the testing. A consultant then works the target for the agreed duration, typically a week for a single application, and you receive a written report with findings rated using CVSS v3.1 and business context applied.
Critical and high findings are raised as they are confirmed rather than held back for the report. A retest of the findings is included once your team has applied fixes.
Read the limitations section of any penetration test report, including ours, and you will find a line about limited time or partial coverage. It is honest rather than evasive. Password spraying has to run slowly to avoid locking accounts out. Content discovery across a large estate takes days per host. Nobody can test the change your team ships the week after testing ended. Those tasks get sampled or dropped, because the week runs out before the work does.
That is the gap continuous testing exists to close, and it is the usual reason clients move their external estate onto it after a first engagement.
Authenticated and unauthenticated assessment of a web application, aligned to OWASP ASVS, covering every layer from client-side logic to server configuration and business logic.
Static and dynamic analysis of iOS and Android applications against OWASP MASVS, covering the binary, runtime behaviour, local storage and the backend it talks to.
API security testing across REST, GraphQL, gRPC and WebSocket interfaces, covering both authenticated and unauthenticated attack paths.
Assessment of your internet-facing estate: what is exposed, what is reachable, and what an attacker without credentials can do with it.
Review of AWS, Azure and Google Cloud environments, focused on the configuration and permission paths that turn a small mistake into account compromise.
Assessment of containerised environments, from image hardening through to live cluster exploitation, across Docker, Kubernetes, OpenShift, EKS, AKS and GKE.
Testing of serverless architectures on AWS Lambda, Azure Functions and Google Cloud Functions.
Assessment of identity infrastructure, single sign-on, privileged access management and conditional access policy.
Red-teaming of applications built on large language models and agentic pipelines, aligned to the OWASP LLM Top 10.
A scoped phishing campaign measuring whether your controls and training hold, reported in aggregate only.
If you need one of these, we would rather point you to someone who does it properly than take the work.
Engagements are quoted on scope: what the target is, how much of it there is, and whether testing is authenticated. A single web application assessed over a week is the common starting point. We confirm the price in a written proposal before anything begins.
Ask about continuous testing at the same time. The base package covers a year of external coverage for roughly what an annual test costs, and it is where the long-running work above actually gets finished. Most clients scope both in one conversation: a deep engagement on the application that matters, and continuous coverage on the estate that keeps moving.