Penetration testing resources
Practical reading for UK teams who buy penetration tests, support them and fix what they uncover.
Using a pentest as evidence
How test reports support a certification audit and an insurance renewal in the UK.
Get the brief right first
Scope, depth, timing, cadence and the questions to put to providers.
The pentest scoping worksheet
Pin down targets, user roles, limits and who will sign the authorisation.
Read resourceBlack, grey or white box
How much to tell testers, and why grey box usually gives UK buyers the best value.
Read resourceTypical pentest durations
Days of testing for each test type, and the lead time and reporting weeks to plan around.
Read resourceHow often to pentest
Annual baselines, change triggers and continuous testing, set against your risk and duties.
Read resourcePentest or bug bounty?
What each model covers, what auditors accept and when running both makes sense.
Read resourceQuestions for a pentest tender
What to ask bidders about method, testers, reports, accreditations and VAT.
Read resourceFor infrastructure and cloud engineers
Where testers start in two targets that turn up in almost every UK estate.
From open findings to signed-off fixes
Interpret the scores, choose a fix order that makes sense and show that each fix holds.
Ready to find your risks before attackers do?
Tell us what you need tested or monitored. A senior consultant replies within one business day with a scoped, fixed-price proposal.
- Fixed-price proposal
- Reply within 1 business day
- NDA on request