Audits & penetration testing
Test the control before someone else does.
Independent security audits and manual penetration testing across applications, APIs, mobile, networks and cloud. Evidence you can act on, fixes your engineers can ship, and a retest that proves the change.
Security audits & assurance
An audit should answer a decision question: are we ready for this customer, this framework, this obligation or this change? We assess the control environment against the standard that matters to you and give you a prioritised view of what is missing, what is weak and what is working.
What we assess
- Gap assessment against ISO/IEC 27001, SOC 2, CIS Controls or contractual requirements
- Control design and operating effectiveness
- Identity, access and privileged-account review
- Cloud configuration and infrastructure review
- Backup, recovery and continuity readiness
- Vendor and third-party risk
- Incident response readiness and tabletop exercises
What you get
Penetration testing & VAPT
We test how an attacker would actually reach your data — not just whether a scanner reports a signature. Testing is manual first and tool-supported where it helps, with a clear scope, written authorisation and safe-testing constraints agreed before we begin.
| Surface | What we test | Typical output |
|---|---|---|
| Web | Authentication, authorisation, input handling, session and business logic | Exploitable findings with reproduction steps |
| API | Object-level access, token handling, rate limits, data exposure | Request-level evidence and fixes |
| Mobile | Local storage, transport, authentication, tampering and platform controls | Findings mapped to platform guidance |
| Network | Exposure, segmentation, identity paths and configuration weaknesses | Attack-path narrative |
| Cloud | IAM, public exposure, logging, key management and guardrails | Misconfiguration findings and remediation |
Findings are rated by exploitability and business impact, with reproducible evidence and remediation guidance. Where a finding needs a product or architectural change, we say so plainly. Retesting confirms the fix.
Rules of engagement
- Written authorisation and an agreed scope before testing
- Named contacts, escalation paths and testing windows
- Explicit constraints on destructive or high-risk actions
- Data handling rules for evidence and screenshots
- Evidence retention and deletion agreed at the start
We only test systems you are authorised to test. If you are unsure who owns a target or what permission you need, we will help you establish that before any testing begins.
How an engagement runs
- Scope. Targets, objectives, constraints, contacts and timing.
- Authorise. Signed rules of engagement and access arrangements.
- Test. Manual testing, evidence capture and progress updates.
- Report. Findings, impact, reproduction and remediation guidance.
- Retest. Confirm fixes and close the loop.
Questions we hear
Will testing disrupt production?
It can if it is not scoped carefully. We agree testing windows, rate limits and prohibited actions in advance. Where a test carries material risk, we use a staging environment or a controlled approach agreed with your team.
Do you provide a compliance certificate?
No. We provide independent test evidence and audit findings. Certifications are issued by certification bodies, not by the consultancy performing the test. We can help you prepare for an audit and remediate what it finds.
How long does a penetration test take?
It depends on the number and complexity of targets. A focused web application test may take days; a multi-surface engagement can take weeks. We give you a scoped estimate after a short technical conversation.
What access do you need?
That depends on the test. Some engagements are black-box; others are grey-box or white-box with credentials and architecture context. We agree the access model in the scope so the result matches the question you need answered.
Can you test our cloud configuration?
Yes. We review identity, network exposure, logging, encryption and guardrails in AWS and other cloud environments, using read-only access where possible. We can combine this with application testing to show the attack path end to end.
Audits & testing
Find the gap before it finds you.
Bring the target, the framework or the customer question. We will scope the smallest test that answers it.