Audit or penetration test?
An audit asks whether the organisation has the right controls, evidence and ownership across systems and processes. A penetration test asks whether a specific system can be exploited under controlled conditions. An audit can reveal a missing access review; a test can reveal that an endpoint lets you bypass it.
Some compliance programmes need both. Neither replaces a risk assessment or a management decision.
What we review
- Identity and access: privileged accounts, MFA, joiners/leavers and access reviews.
- Configuration: cloud, endpoints, logging, backups and update paths.
- Suppliers: critical providers, contracts, concentration and exit evidence.
- Incident readiness: contacts, classification, reporting and exercise records.
- Evidence: policies that match practice, ownership and test dates.
The scope is written before work starts. We avoid broad access to personal data and use read-only evidence where possible.
Process
- Scoping: systems, legal driver, evidence owners and constraints.
- Evidence collection: interviews, configuration extracts and samples.
- Validation: test a sample of controls and follow the evidence trail.
- Findings: severity, business impact, root cause and owner.
- Remediation plan: priority, effort and a proposed retest.
What the report contains
- Scope, limitations and evidence sources.
- Management summary with the top risks.
- Findings with evidence, impact and recommended fix.
- Prioritised remediation plan and owners.
- Mapping to NIS2, E-ITS or ISO 27001 where relevant.
- Retest results where agreed.
We do not issue a generic "compliant" certificate. The report states what was reviewed and what remains uncertain.
NIS2, E-ITS and ISO 27001
An audit can support the evidence pack for NIS2, E-ITS or ISO 27001, but the legal obligation and certification decision remain separate. We map each finding to the relevant control and evidence owner.
Request a scoping call or review the penetration testing scope.
Frequently asked questions
What is the difference between an audit and a penetration test?
An audit reviews governance, access, configuration, suppliers and evidence across systems. A penetration test attempts controlled exploitation of a specific scope. They answer different questions and can complement each other.
Do you need access to production?
Not always. We agree read-only access, screenshots or evidence exports. The scope should minimise access to personal and customer data.
Can an audit prove NIS2 compliance?
An audit can provide evidence, but NIS2 compliance also depends on governance decisions, incident reporting, supplier management and supervisory requirements. We map findings to the relevant duties rather than issue a generic certificate.
What do we receive?
A scope document, findings with evidence and severity, a management summary and a prioritised remediation plan. Retesting can be added.
How long does an audit take?
It depends on the number of systems, locations and evidence owners. A focused review can take days; a multi-site audit takes longer.