Cybersecurity

Penetration Testing

Authorised, controlled attempts to exploit weaknesses in your systems, before an attacker does.

A penetration test goes a step beyond a vulnerability assessment. With your written authorisation, we attempt to exploit weaknesses in the agreed systems in a controlled way, to show what an attacker could actually reach and how. You receive a report of what was tested, what succeeded, the supporting evidence and how to fix it.

Who it’s for

Businesses that want to test their defences realistically
Organisations with audit, client or insurance requirements for a penetration test
Developers and vendors launching a web application or online service

What we examine

External, internet-facing systems
Internal networks
Web applications
Targets, methods and exclusions agreed in writing beforehand

How an engagement works

Scope and rules of engagement

We agree targets, methods, exclusions, testing windows, emergency contacts and written authorisation.

Discovery

The systems in scope are mapped and potential weaknesses identified.

Controlled exploitation

Weaknesses are tested within the agreed rules, taking care to avoid disruption.

Report and debrief

Findings with evidence, risk ratings and remediation steps, with an optional re-test.

What you need

Written authorisation from the owner of every system in scope, and from the hosting or cloud provider where their terms require it
A named technical contact available during testing
Current backups of the systems in scope

What you receive

Executive summary
Technical findings report with evidence and remediation steps
Optional re-test after remediation

Limitations. A penetration test is a time-limited, point-in-time exercise within the agreed scope. It shows what testing achieved, not every weakness that exists, and it does not guarantee that a system is secure. Testing carries some risk of disruption, which the rules of engagement are designed to manage. We only test systems we are authorised in writing to test.

Questions

How is this different from a vulnerability assessment?

A vulnerability assessment identifies and prioritises known weaknesses. A penetration test goes further and, with your authorisation, attempts to exploit them to show their real impact.

Can you test a system hosted by someone else?

Only with written permission from you and, where their terms require it, from the hosting or cloud provider.