What we test
Penetration testing looks for ways an attacker could reach data, take over an account or disrupt a service. The scope is agreed before testing and can include:
- Web applications: authentication, sessions, access control, input handling, file uploads and business logic.
- APIs: authentication, object-level authorisation (BOLA/IDOR), rate limits, data exposure and integration trust.
- Cloud and infrastructure: identity, network exposure, storage, logging and configuration.
- AI and LLM features: prompt injection, retrieval leakage, tool permissions and agent boundaries.
We do not test third-party systems without the provider's permission, and we do not use real customer data when a synthetic test account is enough.
Rules and authorisation
Testing is an intrusive activity. It starts only after a signed scope that names the targets, environments, time window, emergency contact and excluded actions. Production testing is possible when the rules of engagement make it safe; otherwise we use a staging environment that matches production.
We follow the agreed rules of engagement, stop if we encounter a safety issue and report critical findings immediately. A penetration test is not a denial-of-service exercise, social-engineering campaign or physical intrusion unless that is explicitly scoped.
Process
- Scoping call: assets, roles, risk, compliance driver and constraints.
- Authorisation: signed scope, contacts and rules of engagement.
- Reconnaissance: map the attack surface without assuming the architecture diagram is complete.
- Testing: manual validation, tool-assisted checks and controlled exploitation.
- Reporting: evidence, severity, business impact and a fix that fits the stack.
- Retest: confirm fixes where agreed.
What the report contains
- Scope, dates and rules of engagement.
- Executive summary for decision-makers.
- Findings with reproduction steps, evidence and severity.
- Remediation guidance and priority.
- Accepted risks, limitations and out-of-scope items.
- Retest results where purchased.
The report is written for your engineers and your management, not as a raw scanner export. Every material finding is reviewed by a person.
Scoping and price
Price depends on the number of targets, user roles, environments, depth and whether a retest is included. A short scoping call is the fastest way to get a realistic range. We will say what we cannot test and what another specialist should cover.
Request a scoping call or review the NIS2 evidence requirements if the test is part of a compliance programme.
Frequently asked questions
Do you need written permission to test?
Yes. Testing starts only after a signed scope and authorisation that identify the targets, time window, contacts and rules of engagement.
What can be tested?
Web applications, APIs, cloud configuration, authentication and authorisation, and AI/LLM integrations within the agreed scope.
Is this an automated scan?
No. Automated tools support the work, but a person validates findings, checks exploitability and writes the remediation guidance.
How long does a penetration test take?
It depends on the number of targets, roles, environments and the depth of testing. A focused web or API test can take days; a multi-system engagement takes longer.
What do we receive?
A scope document, a findings report with severity and evidence, remediation guidance, a management summary and, where agreed, a retest.