Penetration testing for UK sectors

Our method does not change from client to client. The target does. A UK bank, a SaaS start-up and a hospital trust supplier each answer to different regulators and customers, and each holds something different that an attacker would want. Here is how that changes the scope in six UK sectors.

Financial services and fintech

UK banks, building societies, payment firms and fintechs hold money and the data that moves it. Most serious findings in this sector are logic flaws: a limit enforced in the app but not the server, a payee change that skips step-up checks, or a partner API that accepts any account reference it receives. Open banking connections add third parties into that picture. Under the FCA and PRA operational resilience rules in SYSC 15A, firms name their important business services, fix an impact tolerance for each and test scenarios against them; focused testing of the systems behind those services gives that work real evidence. Firms asked for CBEST should note that it is a Bank of England framework with its own provider requirements, which we don't claim to meet.

• Payments, payee management, limits and approvals under race conditions
• Open banking and partner APIs checked for object-level and function-level authorisation
• Banking and wallet apps reviewed against OWASP MASVS
• Account recovery, device binding and step-up authentication
• Red or purple team scenarios built around an important business service

API penetration testing for UK financial platforms

SaaS and technology

A UK software company usually needs its pentest for two audiences at once. ISO 27001 auditors want evidence that vulnerabilities are managed and that security is tested before release. Enterprise buyers, including those in the United States, often ask for SOC 2 reports and a recent independent test during due diligence. Cross-tenant leakage is the result that loses contracts, so most of our hours go into the walls between customers.

• Tenant separation across screens, APIs, exports, reports and queued jobs
• Admin, support and impersonation tools
• Single sign-on, SCIM and user invitations
• Cloud accounts and Kubernetes clusters that run the product
• A retest letter fit to send prospects under NDA

Web application penetration testing for UK SaaS

Healthcare and NHS suppliers

Health data is sensitive and stays valuable for years, and downtime can affect patient care. Anyone able to reach NHS patient data or NHS systems must complete the Data Security and Protection Toolkit annually, and suppliers are often asked by NHS customers to show their testing. Clinical environments mix modern apps with older systems that cannot be patched quickly, so we agree careful windows and safe techniques with clinical and IT leads first.

• Patient portals, booking tools and remote consultation apps
• Integration engines and HL7 or FHIR interfaces
• Whether clinical networks are really cut off from guest Wi-Fi and office systems
• Medical and building equipment on the network, only within safety limits agreed beforehand
• Findings arranged to support DSPT technical evidence

Internal network penetration testing for health organisations

Retail and e-commerce

UK retailers lose money through business rules as often as through servers. Price manipulation, stacked vouchers, gift card abuse and loyalty point fraud are logic problems that scanners miss. Where you take card payments, PCI DSS v4.0.1 Requirement 11.4 calls for annual internal and external penetration tests, a test after significant change and segmentation testing every year for merchants or every six months for service providers.

• Basket, pricing, voucher, gift card and loyalty logic
• Customer account takeover and saved-card misuse
• Scripts loaded on checkout and payment pages
• Segmentation that keeps the cardholder data environment apart
• Returns, click-and-collect and marketplace seller APIs

Compliance pentesting for UK retailers

Public sector suppliers, education and charities

Companies bidding for UK public contracts meet security questions early. Cyber Essentials has been required for many central government contracts involving personal data since 2014, and procurement questionnaires often ask how and when systems are tested. Universities, schools, colleges and charities face similar questions from funders and partners, usually on tight budgets. Cyber Essentials Plus is a technical audit by a Certification Body rather than a penetration test, but a test beforehand can show where the five controls are weak. Work on government systems that needs CHECK is outside what we claim.

• Readiness testing before a Cyber Essentials Plus audit
• External perimeter and remote access review, including the 14-day patching rule for high and critical updates
• Microsoft 365 and Entra ID configuration for shared or volunteer accounts
• Learning platforms, donor portals and member systems
• Reports written to answer tender and questionnaire wording

External network penetration testing for suppliers and charities

Manufacturing and logistics

A stopped production line or a warehouse that cannot ship is the outcome these firms fear most, and ransomware groups know it. The route usually runs from an office laptop through shared accounts and flat networks into plant or warehouse systems. Third-party maintenance access and handheld scanners on site Wi-Fi often shorten it further.

• Boundaries between office IT and operational technology
• Vendor remote maintenance and support connections
• Active Directory routes into plant, warehouse and transport systems
• Warehouse and yard wireless networks and handheld devices
• Passive or tightly limited testing near live control systems

Active Directory penetration testing for UK manufacturers