Manual security testing
Penetration testing with findings your team can act on
Understand how an attacker could exploit weaknesses in your systems and what to fix first. Our specialists conduct authorised testing, assess business impact and explain practical remediation steps to your technical team.
Who this service is for
Understand vulnerabilities, reduce risk and demonstrate security
- You want an independent assessment of exploitable weaknesses in your systems.
- You need testing to support regulatory, audit or customer security requirements.
- You want to assess security before launching a product or after significant system changes.
- You need to understand the business impact of vulnerabilities and prioritise remediation.
- You want to give customers or partners independent evidence of testing and agreed fixes.
What the work achieves
Understand the risks and know how to address them
-
Exploitable weaknesses and their impact identified
You understand how an attack could affect data, accounts or services, and which findings create the greatest risk within the tested scope.
-
Practical advice for remediation
Your technical team receives reproducible findings and recommended fixes. We explain causes, priorities and how to verify the agreed improvements.
-
Independent evidence for stakeholders
Reports help you demonstrate security work to management, customers and auditors. An agreed re-test shows which identified vulnerabilities have been resolved.
What we cover
Choose what we test
Web and mobile apps, and APIs
We test your web and mobile applications and the connections other software uses to exchange data with them (APIs). That includes checking whether one customer can see another customer’s data.
What is reachable from the internet
We look for ways in from outside: websites, login pages, remote access and other services you run online.
Your internal network
We simulate an attacker with access to a staff device or account and assess how far they could reach. Access and test boundaries are agreed with you beforehand.
Cloud accounts and settings
We check whether cloud settings or permissions let someone reach data or give themselves more access.
Separation between networks
We test whether the barriers between parts of your network, such as office and payment systems, hold.
How much we know before we start
We can test as an outsider, as a logged-in user or with access to your code. Each finds different problems, and we recommend one.
How it works
From testing scope to remediation review
-
01
Agree the limits in writing
We agree the systems, what testers may and may not do, the dates and who to call if something looks wrong.
-
02
Test within those limits
Testers check by hand whether weaknesses can be used to get in, and how far they lead. Between them, our testers hold the OSCE, OSWE, OSCP, CEH, OSWP and CISM certifications. We tell you about anything urgent the same day.
-
03
Explain the results together
Our testers explain findings and their business impact to management and your technical team, with recommendations on remediation priorities.
- 04
Re-test the agreed fixes
After your changes, we test the agreed issues again and record each one as fixed, partly fixed or still open. Your proposal states how long after the report the re-test can take place.
What we need from your team
- One technical contact who can answer questions during the test.
- Test accounts and access, ready before the first testing day.
- Permission from your hosting or cloud provider, if its terms require it.
- The people who will make the fixes, at the results meeting.
Penetration Testing
What sets the cost of a penetration test
Four things set the price: the number of systems, testing depth, the access you give us and any re-test. Your proposal prices each one, so you can see what changes the cost.
We agree the work and price with you in writing before we start.
Common questions
Common questions
Related services
Free 30-minute call
Plan the test you need
On a free 30-minute call, tell us what needs testing and by when, and we help you choose the systems and the depth.
