Public facing websites
Forms, plugins, themes, exposed information and security settings on custom built and CMS websites, within the agreed platform permissions.
Sustain / Your cyber security journey
Penetration Testing & Vulnerability Assessments
Authorised testing of your website, application, API or network, focused on exploitable weaknesses and their business impact. Manual investigation and automated techniques give your team evidence to prioritise fixes.
What you can expect
Actionable assurance, from scope to retest.
Whether you are preparing to launch, introducing a significant change or reviewing an existing service, testing should answer clear questions about your risk. We agree the assets, approach, depth and limits, then give your business and technical team findings they can act on.
01
A clear scope and testing plan
Agree the environment, assets, objectives, access, testing window and permitted techniques. Written authorisation and the boundaries of the engagement are confirmed before testing begins.
02
Testing to the agreed depth
Use manual investigation and appropriate automated tools to examine the agreed assets. Relevant guidance such as OWASP WSTG, PTES and OSSTMM informs the approach; MITRE ATT&CK can inform applicable attack scenarios.
03
A report and findings readout
Receive a plain English executive summary alongside technical findings, supporting evidence, severity, business impact and practical remediation guidance. A readout helps your team understand the priorities and next steps.
04
An agreed retesting allowance
After fixes are implemented, use the time agreed in your scope to check the identified findings and record the outcome. The retesting coverage and timing are agreed upfront; additional testing is scoped separately.
What is included in the agreed scope?
The quote sets out the assets, approach, testing time, deliverables and retesting allowance. Technical implementation is separate and can be delivered by your team, IT provider or separately scoped Security Foundations work. Testing is a point in time assessment within agreed limits; new vulnerabilities and attack techniques can emerge, and no test can guarantee 100% security.
Scope your assurance
What can we test?
The right scope depends on what your business relies on and the questions you need answered. We agree whether a vulnerability assessment, penetration test or a combination best fits the requirement.
Developed applications
Sign ins, sessions, user roles, account separation and business workflows. Code review can be included where specifically scoped.
APIs & integrations
Authentication, access to records, data handling and the security of interactions between connected services.
Networks
Exposed services, remote access and security configuration. Testing of network segmentation can be included where agreed.
How we work together
From clear scope to practical assurance.
A defined engagement, an evidenced report and a clear handover, with agreed time to check the fixes.
- 01
Scope and agree
Confirm written authorisation, targets, access, testing depth, boundaries and the delivery plan.
- 02
Test and validate
Examine the agreed assets and validate relevant findings within the permitted techniques and testing time.
- 03
Report and explain
Provide the findings report and readout, with clear priorities and practical recommendations for your business and technical team.
- 04
Remediate and retest
Your team, IT provider or separately scoped Security Foundations work addresses the findings. We then check the identified fixes within the agreed retesting allowance.
Frequently Asked Questions
What would you
like to know?
Practical answers about this service, its scope and the next step.
Explore all our answersWhat can you test?
The agreed scope can include public facing websites, developed applications, APIs and integrations, or networks. The testing approach depends on the assets, access, depth and boundaries authorised for the engagement.
How is penetration testing different from a vulnerability assessment?
A vulnerability assessment identifies and prioritises potential weaknesses. Penetration testing includes controlled attempts to validate how weaknesses could be exploited and what their impact could be, within agreed limits. We agree the appropriate approach or combination during scoping. A vulnerability assessment should not be treated as equivalent to a penetration test.
What is included in the engagement?
Every engagement includes a scoping session, testing for the agreed time and depth, a full report with remediation recommendations and a findings readout. The report combines an executive summary with technical findings, evidence, severity, impact and testing limitations. Agreed time for retesting identified fixes is included; the coverage and timing are defined in the scope.
How much does testing cost?
Testing starts from £750 per day of testing. The quote reflects project size, complexity, assets and testing depth. We confirm the agreed price, deliverables, testing time and included retesting allowance before work begins. Technical implementation and any additional testing are separately scoped.
Which frameworks inform the testing?
Relevant guidance such as OWASP WSTG, PTES and OSSTMM informs the approach selected for your scope. MITRE ATT&CK can inform applicable attack scenarios. These resources support the testing methodology; they do not mean that every technique or every possible attack is included in an engagement.
Can you test a site before it goes live?
Yes, where we have written authorisation and an agreed test environment and scope. We confirm access, boundaries, dependencies and the effect of any differences between development and the intended live environment.
Can you help address the findings afterwards?
Yes. Security Foundations can turn prioritised testing findings into scoped remediation work, from configuration changes and engineered fixes to implementing controls or deploying a suitable solution. Each module is separately itemised and individually priced at a fixed fee. Implementation is separate from the testing engagement and its agreed retesting allowance.
Is penetration testing the same as Cyber Essentials Plus?
No. Cyber Essentials Plus is an independent technical audit against the scheme’s five controls. A penetration test investigates exploitable weaknesses in the assets and scenarios agreed for that engagement. The two can complement each other, but neither replaces the other. Cyber Essentials preparation, Plus auditing and penetration testing have separate scopes and costs.
Does a successful test guarantee security?
No. Testing is a point in time assessment within the agreed scope and limits. New vulnerabilities and attack techniques continue to emerge, and no test can guarantee 100% security.
A conversation is a good place to start
Let’s make your next step
a confident one.
Start with a free discovery call. Tell us what matters to your business and where you need help. We’ll listen, explore your priorities and help you find a practical way forward.
No cost. No obligation.
