A customer, insurer or regulator has asked for a penetration test. Or your certification needs evidence that your security actually works. Or you simply want to know where you’re exposed before someone else finds out.
Security testing tells you where your weaknesses are and what to do about them. We offer a range of tests, from quick automated scans to hands-on ethical hacking, and we’ll help you choose the one that answers the question you’ve actually been asked, without paying for more than you need.
Every test is carried out by our own team. We don’t pass your systems to a subcontractor.
Which test do I need?
| If you need to… | Start with |
|---|---|
| Prove your defences work, for a customer, insurer or standard | Penetration test |
| Find and fix known weaknesses regularly | Vulnerability scan |
| Check your AWS or Azure set-up is secure | Cloud security assessment |
| Understand your overall risk and where to spend | Security risk assessment |
| See how far you are from ISO 27001 | ISO 27001 gap analysis |
Penetration testing
A penetration test (or pen test) is a controlled attack on your systems by a certified ethical hacker, using automated tools and human ingenuity, to find weaknesses before a real attacker does. Insurers and regulators increasingly ask for one, and standards such as PCI DSS and ISO 27001 often expect regular testing.
There are two main types:
- External test. The tester tries to break in from the internet, as an outside attacker would.
- Internal test. The tester starts from an agreed point inside your network and sees how far they can get, showing, for example, how malware could spread if one PC were compromised by a phishing email. Your data stays safe throughout.
At the end, you get:
- A detailed technical report explaining what was found and how your technical team can fix it
- An executive report in plain English on your risk and what to do next
- A technical call to answer your team’s questions
- A board-level presentation of the findings and recommendations
Managed Cyber Team clients can add an annual penetration test to their service for a small monthly fee.
Vulnerability scanning
A vulnerability scan checks your network, servers, PCs and web applications, in the cloud or on-site, for known weaknesses. You can have a one-off scan for an immediate picture, or a subscription with scans every month or quarter.
Regular scanning helps you meet standards that set deadlines for fixing problems. Cyber Essentials, for example, requires high-risk and critical security updates within 14 days of release, and PCI DSS expects critical security patches within one month. For ISO 27001, it shows you’re following your own vulnerability management policy.
Run before a penetration test, a scan lets you fix the basics first, so the tester can focus on the harder problems and the test costs less.
Managed Cyber Team clients benefit from a monthly vulnerability scan, so they stay compliant all year, not just on the day of the audit. Cyber Essentials Plus clients get our Enhanced Compliance scan of every computer in the month before their audit, so there is time to fix anything it finds.
Cloud security assessment
If your business runs on Amazon Web Services (AWS) or Microsoft Azure, a misconfiguration can leave data exposed: open ports, over-generous permissions or unsecured storage. Our cloud security assessment checks your set-up against AWS and Microsoft best practice and tells you what to fix.
It costs less than a penetration test and often finds the same issues, so it’s a sensible step before one. Fixing what it finds can reduce the scope of a later pen test or, in some cases, mean you don’t need one. Paired with regular vulnerability scans, it keeps your cloud secure all year.
Security risk assessment
A detailed assessment of your organisation against NIST SP 800-53, a comprehensive security controls catalogue from the US National Institute of Standards and Technology. It shows where you’re most at risk so you can put your time and money in the right places.
ISO 27001 gap analysis
A gap analysis shows how close you are to ISO 27001, the international standard for information security management, and exactly what work is left and how long it’s likely to take. It’s carried out by a certified ISO 27001 Lead Implementer and is the natural first step in any ISO 27001 project.
Dark web assessment
A search of the dark web for your organisation’s stolen details and passwords, so you can change them before criminals use them.
What we don’t do
- We don’t hand you a report and walk away. Every finding comes with clear advice on fixing it, and we can do the fixing too through our Managed Cyber Team.
- We don’t sell you a pen test when a cheaper scan or assessment would answer the question.
Talk to us
Tell us who’s asking for the test and why, and we’ll recommend the right one.
Frequently asked questions
What is a penetration test?
It's a controlled attempt by an ethical hacker to break into your systems, followed by a report of what they did, how they did it and what you need to change to stop a real attacker doing the same.
What's the difference between a vulnerability scan and a penetration test?
A vulnerability scan is mostly automated and finds known weaknesses quickly and cheaply, while a penetration test is carried out by a person who tries to exploit weaknesses the way an attacker would. Scans suit regular checks; pen tests are usually done once a year or after big changes.
What's the difference between an internal and an external penetration test?
An external test attacks your network from the internet, as an outsider would. An internal test starts from an agreed point inside your network, to show how far an attacker could get if, for example, one PC were compromised by a phishing email.
Can a vulnerability scan reduce the cost of a penetration test?
Often, yes. Fixing the known issues a scan finds first means the penetration tester spends less time on basics and more on the serious threats, which can reduce the scope, time and cost of the test.
Is a cloud security assessment the same as a penetration test?
No. It reviews how your AWS or Microsoft Azure set-up is configured against best practice, at a lower cost than a penetration test, and fixing what it finds can shrink the scope of a later pen test or, in some cases, mean you don't need one.