Executive summary
Board-readable risk posture, severity mix, and a remediation timeline. Written for a UK director, not a scanner operator.
Home / Services
Services
Penetration testing built around your UK stack.
Manual-first VAPT for United Kingdom product companies and the agencies that ship for them. Web, mobile, cloud, API, network and desktop — with reports that survive Cyber Essentials Plus reviews, ISO 27001 audits and enterprise questionnaires.
Seven lines
Pick the surface. We bring the adversary.
01
02
03
04
05
06
07
Web application VAPT
Login as the wrong user, read another tenant’s records, skip a payment check. If a UK customer’s data is one ID tweak away, we prove it.
OWASP Top 10IDOR / BOLAAuth bypassBusiness logic
02
Mobile app VAPT
Android and iOS: insecure storage, interceptable traffic, pinning that is not pinning, secrets in the binary.
Android / iOSMobSFMITMPinning
03
Cloud security VAPT
AWS, Azure and GCP the way an attacker with one leaked key would: public buckets, over-broad IAM, exposed admin planes.
AWS / Azure / GCPIAMStorage
04
API security testing
REST and GraphQL with two authenticated identities. Object-level authorisation, mass assignment, JWT, OWASP API Top 10.
BOLA / BFLAJWTGraphQL
05
Network penetration testing
External perimeter and internal Active Directory. Forgotten services, weak credentials, how far a foothold actually goes.
External / internalADLateral movement
06
Security audit & reporting
A board summary and a technical report with CVSS, screenshots, exact steps and a fix. Free re-test. Letter of attestation on request.
CVSS v3.1NCSC CAF mapRe-test
07
Desktop & thick-client testing
Windows, macOS, Linux native apps — .NET, Electron, Qt, Java. Reverse engineering, IPC, local privilege.
.NETElectronIPC
On every engagement
Deliverables
Technical report
Per-finding CVSS v3.1, affected asset, reproducible steps, evidence, and a fix a developer can ship this sprint.
Re-test & sign-off
After you patch, we re-test every confirmed issue and issue a sign-off letter for customers and auditors.
Letter of attestation
On request: independent VAPT was performed, dates, scope summary. Useful for ISO 27001, CE+, SOC 2 questionnaires and UK GDPR records of processing.
Every engagement
What is true of all of them, regardless of scope
Manual first, tools second
Scanners run alongside the engagement to cover breadth. They never decide what counts as a finding. Everything in the report was reproduced by hand, because the vulnerabilities that matter — authorisation, tenancy, business logic — require someone who understands what your product is supposed to do.
At least two identities
Every engagement that involves authorisation runs with two accounts at the same privilege level, plus one per role. It is the only way to prove that user A cannot reach user B’s data rather than assume it. If you can only supply one account, we will tell you which findings become unprovable before you sign.
Written authorisation first
Testing a system without the owner’s permission is an offence under the Computer Misuse Act 1990. Every engagement starts with a signed authorisation letter naming the scope, the window and the people involved. We counter-sign it. No exceptions, and no packet before it exists.
Bounded proof
We take enough evidence to make a finding undeniable and then we stop. A few rows, a screenshot, a replay script. We do not bulk-extract your customer data, encrypt anything, or leave persistence behind to demonstrate that we could have.
A re-test in the fee
When you have patched, we verify every confirmed finding and issue a statement of what is closed. It is included, not a change request — because a test with no re-test does not prove anything was fixed, and that is the part your auditor cares about.
An attestation letter on request
One page naming the scope, dates, tester and outcome. It is what enterprise procurement teams are usually asking for when they say they want to see your penetration test, and it lets you evidence the work without circulating your own vulnerability list.
Choosing
Which engagement fits your situation
A customer or insurer is asking for a penetration test
Start with the application that holds their data — usually web or API. That plus an attestation letter answers the great majority of UK enterprise due-diligence requests. Add network only if their questionnaire specifically asks about infrastructure.
You are going through ISO 27001 or renewing it
Your auditor wants evidence of technical vulnerability management, not a specific test type. An application test with a documented re-test, mapped to Annex A, is the cleanest evidence. If your estate is mostly cloud-hosted, cloud covers ground CE+ and an application test both miss.
You already hold Cyber Essentials Plus
CE+ is an audited baseline, not an attacker simulation. It does not attempt to move through your network or test your own application’s logic. Internal network testing shows what happens after a phishing email lands; an application test shows what your own code allows.
You have findings already and need them to stand up
If a previous supplier, a bug bounty programme or your own team produced findings that nobody can act on, security audit and reporting revalidates them, removes the false positives, re-scores against your context and rewrites the document for the people who have to read it.
If none of these describes you, book the call anyway. Thirty minutes usually settles it, and we would rather tell you that you need less than you thought than sell you a week you did not need.
Questions
What UK buyers ask first
Start from what is being asked of you and what holds your customers’ data. A UK SaaS company answering enterprise due diligence usually needs a web application and API test. An organisation worried about ransomware needs internal network testing. A team migrating to AWS or Azure needs a cloud configuration and identity review. We will tell you on the scoping call if you are about to buy the wrong one — including when the answer is a smaller engagement than you asked for.
It is driven by scope — roles, workflows, hosts, tenants — rather than by company size. A focused web application test is typically three to five working days; mobile or API four to seven; cloud or internal network one to two weeks. You get a fixed quote in pounds sterling after a thirty-minute call, with no obligation and no per-seat surprises.
Usually within two to three weeks, sometimes sooner. The critical path is almost always your side: provisioning test accounts and getting the authorisation letter signed. If you have a hard customer deadline, say so on the first call and we will tell you honestly whether it is achievable.
Remote by default, during GMT/BST hours, which is what suits most UK product teams and keeps the cost down. Internal network testing can be run through a VPN or on site. On-site scoping, workshops and debriefs can be arranged in London and other major UK cities where the engagement warrants it.
No, and we will not imply otherwise. If your tender mandates CREST or CHECK membership — normal for critical national infrastructure and much of the public sector — you should use a member firm, and we will say so rather than waste your time. For UK SaaS, fintech, agencies and product companies, what buyers actually read is a manual test with reproducible proof, an honest control mapping and a re-test.
You hear about it the same day we confirm it, by phone or email, with enough detail to start mitigating immediately. Genuinely critical findings are not held back for the report. If it is severe enough that testing should pause, we pause and talk to you first.
Ready to scope a UK engagement?
A thirty-minute call. Assets, timeline, a quote in pounds sterling.
Request a quote