Enterprise-grade testing at SME prices.
Our testers bring 20+ years of experience on enterprise engagements. You get the same depth, the same rigour and the same reporting, priced for a growing business.
- 20+
- Years team experience
- 2019
- Founded
- 8
- Test disciplines
Enterprise pedigree
Our team has tested for large enterprises. That experience now works for businesses your size.
Senior testers only
20+ years of combined experience. The people on your scoping call are the people who test.
Low, fixed costs
One fixed quote after scoping. No day-rate creep, no surprise extras.
Choose what we test. Combine as needed.
Each discipline can run alone or as part of one engagement with a single report.
Web application
Hands-on testing of your web application as both an anonymous visitor and each user role. We focus on the flaws scanners miss: access control, business logic and chained attacks.
What we test
- Authentication and session management
- Role and tenant isolation
- Injection and input handling
- Business-logic abuse
- File upload and client-side issues
Example finding
API
We test REST and GraphQL APIs from the spec up, including the endpoints your front end never calls.
What we test
- Object and function-level authorisation
- Token handling and expiry
- Mass assignment and data exposure
- Rate limiting and resource abuse
- Schema and introspection leaks
Example finding
External infrastructure
Everything an attacker can reach from the internet, tested for weaknesses that give a foothold.
What we test
- Asset and service discovery
- Exposed admin interfaces
- TLS and service configuration
- VPN and remote access
- Known vulnerabilities, verified by hand
Example finding
Internal network
We assume a breach and show how far an attacker could move inside your network.
What we test
- Active Directory weaknesses
- Privilege escalation paths
- Lateral movement and segmentation
- Credential exposure
- Legacy and unpatched hosts
Example finding
Cloud (AWS, Azure, GCP)
A configuration and exposure review of your cloud accounts, plus testing of what’s reachable from outside.
What we test
- IAM policies and privilege escalation
- Storage and data exposure
- Network security groups
- Logging and monitoring gaps
- Secrets and key management
Example finding
Amazon SP-API security
Testing built around Amazon’s Data Protection Policy, for developers handling seller and buyer data through the Selling Partner API.
What we test
- PII storage and retention
- Encryption in transit and at rest
- Credential and token storage
- Access control and logging
- Incident response readiness
Example finding
Retesting
Already fixed issues from a previous test, ours or another provider’s? We verify each fix and reissue the report.
What we test
- Each previously reported finding
- Regression around the fix
- Closure evidence
Example finding
Continuous scanning
Scheduled vulnerability scanning between manual tests, triaged by a tester so you only see what matters.
What we test
- External hosts and services
- Web applications
- New and changed assets
Example finding
Manual first. Recognised frameworks throughout.
Scanners find the obvious. Most serious issues, like broken access control and business-logic flaws, only surface under hands-on testing.
WSTG, ASVS & API Top 10
The reference for web and API testing coverage.
Penetration Testing Execution Standard
Structures every phase from recon to reporting.
SP 800-115
Technical guide to security testing and assessment.
Consistent risk scoring
Every finding rated so you know what to fix first.
From first call to signed-off retest.
Every engagement follows the same five steps. Dates are agreed at scoping.
Scoping call
Agree targets, windows and rules of engagement.
Quote and kick-off
Fixed quote, signed authorisation, access set up.
Testing
Hands-on testing with daily updates. Critical issues reported the same day.
Reporting
Report delivered and walked through with your team.
Retest
Fixes verified, report reissued, attestation letter issued.
ConfidentialA report your board and your engineers can both use.
Every finding is rated, reproducible and paired with a fix. The format drops straight into SOC 2, ISO 27001, PCI DSS and Amazon SP-API evidence packs.
- Plain-English executive summary and risk rating
- CVSS-scored findings with proof of concept
- Prioritised remediation plan
- Attestation letter for customers and auditors
One test. The evidence your framework asks for.
Tell us your driver at scoping and we’ll shape the report to match.
| Framework | Relevant requirement | How our test helps |
|---|---|---|
| SOC 2 | CC4.1 · CC7.1Evaluate controls and identify vulnerabilities. | Independent test report and retest evidence your auditor can reference directly. |
| ISO 27001 | Annex A 8.8 · 8.29Manage technical vulnerabilities and test security in development. | Findings and remediation records that support your Statement of Applicability. |
| PCI DSS v4.0 | Requirement 11.4Internal and external penetration testing, including segmentation. | Testing scoped to your cardholder data environment, with segmentation checks. |
| Cyber Essentials | CE and CE PlusFive technical controls, verified by an assessor for Plus. | Finds the gaps an assessor would, before your assessment. |
| Amazon SP-API | Data Protection PolicyRegular vulnerability scanning and penetration testing for PII access. | DPP-mapped report and evidence for your developer profile review. |
A test is a snapshot. Security is ongoing.
Three services that keep your results from going stale, all run by the testers who found the issues.
- Included
Retest and remediation support
Every engagement includes a retest of your fixes. If you want help making them, our engineers work alongside your team and verify each one.
NV-001 · Broken object-level authBefore GET /orders/10482 → 200After GET /orders/10482 → 403Closed · retest passed - Monthly
Continuous testing
Scheduled scans of your external estate and applications, triaged by a tester. Critical findings reach you the same day, not at the next report.
Open findings by monthNew asset flagged - Part-time lead
Security advisory (vCISO)
A fractional security lead for your roadmap, risk register, policies and board reporting, shaped by what your tests actually find.
- Q1Policies and risk register
- Q2Fix top findings, MFA rollout
- Q3SOC 2 readiness
- Q4Board review and retest
- Q1
All of it, in one retainer.
Combine continuous testing, periodic manual tests, retests and advisory hours with a named security contact. Scale it up or down as you grow.
Tested hard. Handled safely.
Written authorisation first
Nothing is tested until scope and permission are signed by you.
Agreed test windows
We test when it suits you, including out of hours and weekends.
Production-safe by default
No destructive or denial-of-service tests without explicit approval.
Direct line to the lead tester
A named contact and an agreed stop procedure throughout.
Your data stays protected
NDA as standard. Evidence is encrypted and securely deleted after the engagement.
Same-day critical alerts
Serious issues reach you when we find them, not in the final report.
Common questions.
Anything else, ask us on the scoping call.
Will testing disrupt our live systems?
Our methods are production-safe by default. We agree test windows in advance, avoid destructive techniques unless you approve them, and can pause immediately if you ask.
Why are your prices lower than larger firms?
You pay for senior testers’ time, not layers of account management and overhead. The depth and reporting standard are the same as our enterprise work.
Should we test production or staging?
Production gives the most accurate picture. Staging works well if it closely mirrors production. We’ll recommend the right option on your scoping call.
How much notice do you need?
We can usually start soon after a signed quote. If you have an audit deadline, tell us at scoping and we’ll plan around it.
Will the report satisfy our auditor or Amazon?
Yes. Reports are structured for SOC 2, ISO 27001, PCI DSS and Amazon’s Data Protection Policy, and include an attestation letter after retest.
Do you sign NDAs?
Always. An NDA is part of our standard engagement paperwork, and we’re happy to review yours.
What happens after the report?
We walk your team through the findings, answer questions while you fix, then retest and reissue the report with closed findings.
Tell us what to test.
Three short steps. We’ll confirm a call time and come prepared with a draft scope.
- 01We reply to confirm your call slot
- 02A senior tester walks through your scope with you
- 03You receive a fixed quote and proposed dates