An external test shows what anyone on the internet can reach. An internal test starts from a foothold an attacker might gain, such as a phished laptop, and shows how far they could get from there.
We map what you expose in practice, whatever the asset register says, and we stay within the limits we agree with you before we start.
Every internet-facing address in scope: open services, remote access, VPNs, mail servers and anything that answers when it shouldn't.
We start from an ordinary network connection or a standard user's laptop and see how far we can move from there.
Accounts, groups, delegation and trust settings, and the usual routes from a domain user to domain administrator.
Whether the boundaries between your networks hold, for example between offices, servers, production systems and guest Wi-Fi.
Corporate and guest Wi-Fi: encryption, authentication and whether a visitor can get from one onto the other.
Most internal testing runs remotely through a small device or virtual machine you set up for us. We come on site when a test needs it, as wireless testing does.
Each finding comes with the evidence behind it, a CVSS rating, the business impact and a concrete fix. Where it applies, that includes the requests and responses or the configuration details that show the problem. It's written so you can pass it to an engineer unchanged.
Two pages in plain language on the business impact and the priorities, written for your board or your customer's security team.
A working session with your engineers where we go through the findings, answer questions and agree how to prioritise the fixes. We can record it if you like.
We plan to avoid it. Before we start, we agree the timing, the methods and the conditions for stopping with you. Tests that could affect availability only run with your written approval.
Yes. You set up a small device or a virtual machine on your network, and we connect to it over an encrypted link. We send you instructions and help you set it up.
The address ranges and domains in scope and a contact who can act if something goes wrong. For an internal test we also need the access we agreed on, which for an assumed-breach test is usually an ordinary user account.
Whenever suits you. Most tests run in working hours, so your team can respond if they need to, but we can test out of hours where that lowers the risk to your business.
Book a scoping call, and we'll send you a fixed quote as soon as we've agreed what to test.