S.2Support and operationsPentest

Security testing

We find out where an intruder could get into your systems, within limits agreed with you, and explain the risk of each weakness in terms management understands.

Signs you need this

  • A funder, an auditor or a client has asked for evidence that your systems are protected.
  • Nobody has checked the network or the website again since they were installed.
  • There has been a fraud or a hacked account, and nobody knows whether the way in is still open.

Few organisations know exactly what they have left exposed: a former employee's account that nobody disabled, a device still using its factory password, a copy of data forgotten in a folder anyone can open. None of this gives any warning until someone takes advantage of it, and by then the discovery comes too late.

We begin by agreeing the scope and the dates with you, so that testing does not interrupt the working day. A systematic vulnerability assessment of the network, servers and applications follows, and then controlled penetration tests in which we try to get in using the same methods as an attacker, without going beyond the agreed limits.

The report ranks the weaknesses by severity and explains what is at risk in business terms. It comes with a remediation plan in order of priority; we help tighten the configuration of your systems and test again to confirm that each weakness has been closed. The same report serves as evidence of due diligence to funders, clients and regulators.

How we deliver

  1. Agreed scope

    We define with you what is tested, when, and what is left out, so that operations are not affected.

  2. Vulnerability assessment

    We work through the network, servers and applications looking for known weak points.

  3. Controlled penetration tests

    We try to exploit the weaknesses found, within the agreed limits, to measure the real risk.

  4. Report and remediation plan

    We rank each weakness by severity and propose the order in which to fix them.

  5. Remediation and retest

    We help tighten the configuration of your systems and repeat the tests to confirm the weaknesses are closed.

What you keep

  1. A scope document, agreed before the first test
  2. A report ranking each weakness by severity and explaining the risk in business language
  3. A remediation plan in order of priority
  4. A retest report showing the status of each weakness
Technology mapAll layers