Know what an attacker could reach, and what to fix first.
A fixed scope, a fixed fee and a fixed end date. Then one report that your directors and your engineers can each act on.
Start from what is happening, not from the jargon.
Pick the sentence that sounds like your week.
Customers want proof that someone independent has looked. An assessment gives you that without a simulated attack, and a clear list of what to fix.
Five tests. Each answers one question.
If you are unsure which one you need, the scoping call settles it.
Vulnerability assessment
A structured look for known weaknesses and misconfigurations, without trying to break in. The right start when you need a clear fix list.
Vulnerability assessment
We review the systems you name and look for known weaknesses and poor setup. We do not try to break in. Think of it as an independent inspection: what is out of date, what is left open, and what would matter most if it were abused.
The right first step when nobody has looked independently before, when a customer or insurer has asked what testing you do, or when you want a fix list before spending more on a fuller test. We do not change your systems.
External network test
A test of everything a stranger on the internet can reach, from websites and email to remote access. The right start when the question is what is exposed from outside.
External network test
We look at the internet-facing systems you name, as an outsider would, and check which are reachable, how they are set up, and whether any weakness could be used to get in. Where the agreed scope allows, we confirm a weakness is real rather than guessing.
The right test when an insurer, customer or board member asks what is visible from outside, when you have changed hosting or remote access, or when an assessment has shown exposed services. We stay inside the systems and hours agreed in writing.
Internal network test
A test from the inside, assuming one device or password is already compromised. The right start when the worry is how far an intruder could get.
Internal network test
We start where a stolen laptop, a phished password or an unwelcome visitor would leave an attacker: inside your network. We then check what they could see, reach and take, and how far one foothold could spread.
The right test when sensitive data sits on shared systems, when staff work from many devices, or when an outside view looks clean and you want to know what lies behind it. If a check looks risky, we stop and call your named contact.
Web application test
A hands-on test of the login, forms and customer data in a website or portal. The right start before a launch or after a major change.
Web application test
We use your application the way a curious or hostile user would: signing in, altering requests, and trying to see data that belongs to someone else or skip a step that should be enforced. It goes deeper than an automated scan because it tests how the application behaves.
The right test before a launch, after a major release, or when the application holds personal, payment or confidential data. We usually test with accounts you provide, so no real customer is affected.
Cloud test
A review of how your Microsoft 365, Google, Azure or AWS accounts are set up. The right start when your files and email live in the cloud.
Cloud test
The provider secures the platform; you secure the settings. We review who can sign in, what they can reach, and whether storage, sharing and admin rights are set up safely. Most cloud exposure comes from configuration, so that is where we look.
The right test when you moved to the cloud quickly, when several people hold admin rights, or when a customer asks how your cloud accounts are protected. Wherever possible we use read-only access agreed beforehand.
What an engagement looks like
A statement of work names the systems, dates, hours and emergency contact. Testing starts only once it is signed.
Only the named systems, only in the agreed hours, up to a fixed end date.
Delivered within 10 working days of the end date, with the business impact first and the fixes behind it.
Leadership first, then the technical team, on the same findings.
What you can hold us to
No new accounts, no hidden way back in, no changes to live data.
If a service slows or a check looks risky, we pause and call the contact you named.
A test shows what was found. It cannot prove nothing else exists, and we will not pretend otherwise.
One report, two readers.
Switch between what a director reads and what an engineer needs. Sample only, not a client engagement. Read the full sample report
Two issues need a decision this month: one critical, one high.
Anyone on the internet can attempt to log in to remote access, and nothing stops a guessed or reused password from working. If that happens, the person is no longer outside the organisation.
VS-01 Remote access exposed to the internet
Policy minimum length 6, no second factor
Result portal reachable from the internet
Do this first: require a second factor for every remote login, stop accepting short passwords, and turn on lockout. Then limit access to trusted locations and remove unused accounts.
What public incidents show
These are well-documented public cases. A test cannot promise every weakness will be found, but it is a sound way to check for this kind of issue early, on your own terms.
A known flaw in a web component, with a patch available for months.
The breach began on a public-facing legacy website. About 157,000 customers affected.
Attackers skimmed payment details from about 400,000 customers via the public website.
Remote access stolen from a supplier, then used to move across the internal network.
Questions people ask first
Yes. We hold professional indemnity and cyber insurance, and can send a certificate on request.
No. Describe what prompted it, such as a questionnaire, an insurer or a new portal. We recommend a starting point and write the scope in plain English.
It is not designed to. We test only the systems named, in the hours agreed, and if a check might affect the working day we stop and call your named contact.
One fixed fee, written into the statement of work before anything starts. We quote after the scoping call, once the scope is clear.
Then you hold independent evidence for customers and insurers, and we say so plainly. A clean result is still a useful result.
Tell us what is prompting this.
A rough description is enough. We will reply with a sensible starting point, or tell you honestly if we are not the right fit.
Book a scoping callInsurance certificate available on request.