Testing scoped to the question you actually need answered.

01

Penetration Testing

Time-boxed, objective-driven testing of a defined target: web application, API, internal network, mobile or cloud environment.

Typical duration

Two to four weeks, depending on scope

Commonly used for

Pre-release assurance, annual testing cycles, customer and regulator evidence

A penetration test answers one question precisely: what can an attacker achieve against this system, from this starting position, inside this window? We work from a written threat model rather than a scanner queue, and we chain findings the way an attacker would, so a low-severity information leak plus a weak session boundary is reported as the account takeover it actually enables. Every finding is manually verified and carries the evidence needed to reproduce it.

What you receive

• Technical report with reproduction steps, evidence and CVSS v3.1 scoring
• Executive summary written for the people who approve the budget, not the exploit
• Ranked remediation plan with specific fix guidance per finding
• Live walkthrough session with your engineering team
• Retest of remediated findings within 90 days, included in the fee

02

Red Team Engagements

Goal-based adversary simulation against people, process and technology, run without advance warning to your defenders.

Typical duration

Four to eight weeks, including infrastructure preparation

Commonly used for

Organisations with an internal SOC or managed detection provider

A red team engagement measures detection and response, not just exposure. We agree an objective with a small group of trusted stakeholders, then work toward it under realistic constraints: phased command and control infrastructure, controlled social engineering, and tradecraft mapped to MITRE ATT&CK. The deliverable is not a finding count. It is an honest answer to whether your security team saw the activity, how long it took them, and what happened when they escalated.

What you receive

• Stage by stage narrative of the full attack path, from initial access to objective
• Detection timeline mapped against MITRE ATT&CK techniques
• Assessment of alerting, triage and escalation performance
• Purple team replay run alongside your defenders
• Prioritised detection engineering recommendations with test cases

03

Vulnerability Assessments

Broad, repeatable coverage across the estate, with human triage layered over automated discovery.

Typical duration

One to two weeks per cycle, monthly or quarterly

Commonly used for

Fast-changing estates, acquisition due diligence, continuous compliance evidence

Assessment answers a different question to a penetration test: what is exposed, across everything, right now. We enumerate the external and internal estate, run authenticated and unauthenticated checks, then triage every result by hand so your team receives findings rather than raw tool output. Run on a recurring cycle, the comparison between cycles becomes the more useful deliverable: it shows whether exposure is genuinely falling or simply moving around.

What you receive

• Asset and exposure inventory for the agreed ranges and cloud accounts
• Triaged findings with false positives removed before they reach you
• Severity ranked by exploitability in your environment, not by raw CVSS alone
• Trend comparison against previous cycles
• Machine-readable export for your issue tracker

04

Exploit Development

Proof-of-concept and weaponised exploit research for the findings that need to be proven rather than argued about.

Typical duration

Scoped per target following a technical review

Commonly used for

Product security teams, appliance and hardware vendors, disputed findings

Some findings only get fixed once somebody demonstrates them. We build reliable proof-of-concept code against vulnerabilities in your own software, appliances and embedded devices, covering memory corruption, unsafe deserialisation, authentication bypass and logic flaws in bespoke protocols. Work runs under a written research agreement with explicit handling rules, and where a third-party vendor is involved we manage coordinated disclosure on your behalf.

What you receive

• Reliable proof-of-concept with a documented trigger path and constraints
• Root cause analysis down to the offending code path
• Exploitability assessment against the mitigations already deployed
• Patch validation once your fix lands
• Coordinated disclosure support, including CVE handling

05

Security Training and Workshops

Hands-on offensive training delivered by the consultants who run the engagements, using material drawn from real findings.

Typical duration

Half day to three days, cohorts of up to 16 people

Commonly used for

Engineering teams, new joiners, security champion programmes

Generic security awareness content changes very little. Our sessions are practical: participants attack a deliberately vulnerable environment modelled on your own stack, understand why each flaw exists, then fix it and prove the fix holds. We run secure code review clinics for developers, threat modelling workshops for architects, and detection labs for defenders who want to see what the telemetry looks like from the other side.

What you receive

• Half day, full day or multi-day formats, delivered remotely or onsite
• Lab environment modelled on your stack, kept available for 30 days afterwards
• Exercises built from findings in your own codebase where permission allows
• Threat modelling clinic against a system your team nominates
• Written summary of the gaps the session exposed, for your training plan