Fixed-scope assessments
A defined scope, timeline and report. Best for testing, reviews and readiness work.
Know where you stand.
An independent view of how your systems hold up against a determined attacker, and what to fix first.
Most organisations know their systems from the inside. An assessment shows them from the outside, the way an attacker would see them: which doors are open, which can be forced and which matter most to the business.
What we deliver
- Penetration testing of web, mobile, API, network and cloud
- Red-team exercises
- Social-engineering assessments
- Cloud security posture reviews
What you receive
- Executive summary
- The risk in business terms, for leadership and the board.
- Technical findings
- Each issue with evidence, severity, how it can be exploited and how to fix it.
- Remediation plan
- Findings ordered by risk and effort, so the team knows what to do first.
- Re-test
- Confirmation that fixed issues are closed.
How an engagement runs
- Scope
- We agree what is in and out of scope, the rules of engagement and who to call if something critical is found.
- Prepare
- Access, accounts and test windows are arranged so the work does not disrupt your operations.
- Deliver
- The assessment, design or readiness work itself, with progress updates at agreed points.
- Report
- Every engagement ends with an executive summary and a prioritised remediation plan.
- Verify
- Once fixes are made, we re-test or review them and confirm what has been closed.
How we engage
Managed security retainers
Ongoing monitoring, vulnerability management and advice, delivered with Kytheos.
Retained incident response
Agreed response arrangements in place before you need them.
Concessional SME packages
Assessments and awareness training sized for small and mid-sized businesses.
Questions clients ask
Will testing disrupt our systems?
Testing is planned around agreed windows and rules of engagement. Anything that could affect availability is agreed with you first.
How often should we test?
At least once a year, and after any significant change to a system that handles sensitive data.
Is our information kept confidential?
We never name clients, breaches or findings without written permission.
Begin with an assessment.
Our work follows recognised frameworks, including OWASP, NIST CSF and MITRE ATT&CK. Every engagement ends with an executive summary and a prioritised remediation plan.