Security assessments
Six ways to find out what an attacker could reach, how they would get there, and what it takes to close the path. Every engagement is authorised in writing, tested under control, and reported with evidence. Each service answers a specific question about your exposure: pick the area that matches the decision you need to make, or send us the context and we will scope it with you.
External exposure assessment
We map what is visible from the internet and check which of it can actually be used. Reconnaissance and controlled validation across domains, DNS, exposed services, remote access, and email security.
What we test
- Domains and DNS records
- Exposed services, VPN, and remote access
- Email security controls
- Admin surfaces reachable from the internet
What you receive
- A map of the external scope that was tested
- Validated findings, each with evidence and impact
- A fix order that puts the highest-risk items first
Web application penetration test
Manual testing of the portals, dashboards, and APIs your business runs on, covering authentication, role boundaries, session handling, file workflows, and business logic.
What we test
- Authentication and session handling
- Roles and the boundaries between them
- Portals, dashboards, and APIs
- Business logic abuse paths, including file workflows
What you receive
- An account of how each issue was exploited
- Reproduction steps anyone on your team can follow
- Fix guidance for every finding
Microsoft 365 and Entra ID review
A controlled review of your Microsoft 365 and Entra ID setup: how privilege, conditional access, mailboxes, and tokens combine into a path to wider compromise.
What we test
- Privilege paths and who can walk them
- Conditional access gaps and MFA assumptions
- Mailbox exposure and token risk
- Likely lateral movement opportunities
What you receive
- The attack paths an intruder would follow
- The policy gaps that leave those paths open
- Notes on what your defences would detect
Phishing resilience assessment
Business-safe campaigns that show how your team responds to a convincing message, without embarrassing anyone along the way.
What we test
- Realistic pretexts sent to your staff
- The decision points people reach when a message looks legitimate
- How people respond while the campaign runs
What you receive
- The pretexts used in the campaign
- Behaviour data showing what staff did with the message
- Response actions and training priorities for the team
Vulnerability management programme
We turn scanning output into a working risk queue: validated findings, clear asset ownership, honest severity judgement, and a rhythm for fixes and retests.
What we test
- Scanning output across your assets
- Asset ownership, so every finding has somewhere to go
- Severity, so real risk is separated from scanner noise
- Your fix rhythm and retest discipline
What you receive
- A triage model that turns scans into a ranked risk queue
- Agreed fix timelines by severity
- Trend reporting that shows progress over time
Breach readiness exercise
Tabletop and technical exercises for leadership, IT, and communications, so decisions are rehearsed before a real incident forces them under pressure.
What we test
- Tabletop scenarios worked through by leadership
- Technical response steps taken by IT
- Communications decisions during an incident
What you receive
- The scenario your team worked through
- A decision log showing who decided what
- Gaps found in your runbooks
Before, during, and after a test
Rules of engagement are agreed before any target is touched.
Before testing
Rules of engagement, written authorisation, test windows, escalation contacts, exclusions, and data-handling expectations.
During testing
Evidence is captured as the work happens, with material risk separated from interesting but low-impact noise.
After testing
Critical and high findings close through verification, not through a ticket status change.
Ready to scope an assessment?
Send the systems you want tested, your deadline, and any constraints we need to work within.