Manual testing of web and mobile apps, APIs, networks, servers and cloud. You get evidence for every finding and a retest of your fixes, and you can talk directly to the consultant who found each issue.
Help with security decisions before and after a test: threat modelling, design reviews, secure development practices and choosing which fixes come first.
Ongoing testing and advice without adding to your headcount, from a named consultant who already knows your estate.
Every finding we report comes with the evidence behind it and, where it applies, the requests and responses that show it and the steps to reproduce it. Nothing gets reported as a bare "medium risk, review recommended".
You get a technical report for the people fixing the problems and an executive summary for the people funding the work, and we'll walk both rooms through it.
Most engagements take one to three weeks from start to finish. A single web application usually needs five days of testing plus time for the report, and a full external estate takes longer. We'll give you a fixed timeline when we agree the scope, and we stick to it.
We plan to avoid it. Before we start, we agree the methods, the timing and the conditions for stopping with you. Destructive and denial-of-service tests only happen with your explicit written approval. Testing a live system always carries some risk, so we set up safeguards with your team, and you'll have a named contact you can reach throughout the test window.
Automated tools are only the starting point. A consultant checks every finding by hand before it goes in the report.
Yes. We support your team while it works through the fixes, and once they're in place we retest them. The details are set out in your proposal. If you need help after that, you can keep us on a retainer.