From first call to closed.
A penetration test should feel controlled from the inside. You know what we are testing, when, how we will reach you, and what happens when we find something serious.
Scoping
A call to understand what you run, what changed recently and what keeps you up at night. We recommend the smallest test that answers your real question, then send a clear written proposal.
- Systems, environments and user roles in scope
- Black, grey or white-box, and why
- Timing that avoids your release windows
Rules of engagement
Before any testing, we agree in writing exactly what is allowed: targets, hours, techniques, data handling and who to call. Nothing is touched without authorisation.
- Named contacts on both sides, with an escalation path
- Exclusions for fragile or production-critical systems
- How test data and evidence are stored and destroyed
Testing
Manual, adversary-grade testing by certified practitioners, using current tradecraft rather than last year's checklist. Scanners handle coverage; people find the chains that matter.
- Critical findings escalated to you within hours, not at the end
- Every finding exploited and reproduced, so there are no false positives
- Techniques mapped to MITRE ATT&CK, so your SOC can test its detections
Reporting
A professional report written for two audiences: an executive summary leadership can act on, and technical detail your engineers can reproduce and fix.
- CVSS severity, evidence and business impact for every finding
- The full attack path wherever findings chain together
- Remediation and detection guidance tailored to your stack
Remediation and retest
We walk your team through the findings, answer questions as you fix them, and retest to confirm each issue is closed. Our help continues until it is resolved.
- A walkthrough call with the people doing the work
- Fix reviews as you go, not just at the end
- A retest and an updated report showing what is closed
Questions we are asked first.
How long does a penetration test take?
It depends on scope. A focused web application or API test is usually days; a broad internal or cloud assessment can take longer. We will give you a firm estimate after the scoping call, before you commit to anything.
Will testing disrupt our systems?
We agree exclusions, timings and techniques in the rules of engagement, avoid destructive testing unless you explicitly ask for it, and stop and call you if anything behaves unexpectedly.
Do you test production or staging?
Either, and we will help you choose. Staging is safer to test aggressively; production is what an attacker actually sees. Many clients test staging in depth and production more carefully.
What do you need from us?
A named contact, written authorisation, and whatever access the chosen approach needs: test accounts, documentation, VPN or cloud read-only roles. We will send a short checklist after scoping.
Is the retest included?
We include a retest so you have evidence that the issues are closed. Tell us your timeline for fixes and we will plan it in from the start.
How do you handle our data?
Evidence is kept to the minimum needed to prove a finding, stored encrypted, shared only with your named contacts, and destroyed on an agreed schedule after the engagement.
Start with a conversation.
Thirty minutes is usually enough to understand what you run and what a useful test looks like.