A URL, an IP range or a short description of what you've built is enough to get started.
On a short call we agree what's in scope, when we test and who we call if we find something critical.
After the call, we send you a fixed price and a timeline.
Once you've signed the authorisation, we start on the dates we agreed.
A penetration test shows what an attacker could do with an app, network, server or cloud estate you already run. Consulting is for the questions a test doesn't answer: how to design a system, which fixes to make first and how to stop the same problems coming back. If you're still not sure, describe what you have on the scoping call and we'll recommend one.
It depends on the scope. As a guide, a single web application or a small external perimeter takes about five testing days, an application with its API and infrastructure about ten, and several applications tested internally and externally twenty or more. After the scoping call you get a fixed quote, so you know the cost before we start.
A project suits one piece of work with a clear deadline, such as a release, a customer requirement or your annual assurance cycle. If security work comes up all year, a retainer makes more sense: you draw down consultant days as you need them, and your named lead already knows your estate. You can also start with a project and keep us on a retainer afterwards.
A test isn't always the right first step. If you're still designing the system, a threat modelling and architecture review catches design flaws before any code exists. If you don't know where your weak spots are, a short consulting engagement helps you decide what to test first.
Tell us what you've built and we'll suggest where to start.