Penetration testing · United Kingdom
Senior-led penetration testing. No juniors. No surprises.
Manual testing of your networks, applications and people, carried out by a tester with over ten years' experience securing banks, government and national infrastructure. The person you speak to is the person who tests.
Fixed quote within three working days · Retest included · Out-of-hours testing at no extra cost
Attack path: one phishing click to full domain control
- 01Standard user account on a staff laptop
- 02Service account with a weak, crackable password
- 03Excessive delegation rights on a server
- 04Domain administrator access
Fix: rotate to a 25+ character managed password, remove unconstrained delegation, alert on ticket requests. 3 steps, about 2 hours.
Three promises, in writing, on every engagement
The person you speak to is the person who tests
No account managers and no hand-off to a junior. A senior tester scopes, tests, writes and debriefs your engagement.
A fixed quote, with the retest included
A fixed price within three working days of a short scoping call. One retest within 90 days and rescheduling are free.
Reports your board and developers can both use
A plain-English summary for leadership, attack paths that show how issues connect, and step-by-step fixes for your team.
Services
Six tests. Each one done properly.
See your internet-facing systems the way an attacker does, before one finds the gap.
02Internal testingFind the Active Directory attack paths that turn one compromised laptop into a full breach.
03Web application testingBusiness-logic and access-control flaws that automated scanners miss.
04API testingREST and GraphQL endpoints tested for broken authorisation, data exposure and abuse.
05Mobile application testingiOS and Android apps and the APIs behind them, tested to fintech standards.
06Social engineering testingPhishing and phone-pretext simulations that measure human risk without blaming staff.
Why do you need a test right now?
Most tests start with a deadline. Tell us yours and we'll recommend the smallest scope that answers it.
- A customer sent a security questionnaireWeb + API
- ISO 27001, SOC 2 or PCI DSS evidenceExternal + Internal
- Preparing for Cyber Essentials PlusExternal + Internal
- Launching a new app or productWeb + API + Mobile
- An insurer or investor asked for proofExternal + Social engineering
How an engagement works
- STEP 1Scoping call
15 minutes with your tester to agree what matters and what's in scope.
- STEP 2Fixed quote
A fixed price and written scope within three working days.
- STEP 3Testing
During or outside office hours. Critical issues are reported to you immediately.
- STEP 4Report, debrief, retest
A clear report, a walkthrough call, and a free retest once you've fixed things.
Experience you'd normally only get from a big firm
The report
What you're actually paying for
A pentest is only as good as what you can do with the report. Ours are written by the person who did the testing, never generated by a scanner.
- Executive summary
Overall risk in plain English, for leadership and auditors.
- Attack paths
How individual issues combine into a real breach.
- Prioritised findings
Risk-rated by real-world impact, with evidence for each issue.
- Step-by-step fixes
Specific remediation your team can act on straight away.
Insights
All articles →How attackers misuse machine accounts in Active Directory, from the default quota to old pre-created accounts, and the settings that shut each route down.
TechnicalResource-based constrained delegation, explainedWhat resource-based constrained delegation is, why attackers love it for moving through Active Directory, and how to detect and prevent its abuse.
TechnicalThe OWASP Top 10 (2025), explainedA plain-English guide to the OWASP Top 10 2025 web application risks, what changed from 2021, and what each category means for your application and team.
Know exactly what your test will cost by tomorrow
Tell us what you need tested. You'll get questions or a fixed quote within three working days.