One real finding, on us.
Tell us what to test. We will work one scoped target by hand and give you a verified Medium, High or Critical vulnerability — fully written up, yours to keep, whether or not you ever engage us.
You submit the target
One web application, API or external host, in whichever environment you prefer — development, UAT or production.
We send an authorisation form
A short scope and permission document. It must be signed by someone able to authorise testing for that system.
We test — usually within five working days
A tester works the target manually inside the agreed scope. No destructive techniques, no data exfiltration beyond what evidences a finding.
You get the finding
Description, reproduction steps, evidence, CVSS score and remediation guidance. Delivered securely. No sales call required to receive it.
Read this before you submit
Accessing or testing a computer system without authorisation from its owner is a criminal offence in most jurisdictions — the Computer Misuse Act 1990 in the UK, the Computer Fraud and Abuse Act in the US, and equivalent legislation elsewhere. This applies to us as testers and to you if you commission testing of a system you do not control.
So: we only test systems you own or are demonstrably authorised to have tested. Submitting this form starts a conversation. It does not start testing. Nothing is touched until written authorisation is signed and we have verified the domain genuinely belongs to your organisation.
If the target is hosted or managed by a third party — a cloud provider, hosting company or managed service provider — your agreement with them may require their notification or approval as well. We will flag this during scoping.
Submit a target
Every field marked required is genuinely required — we cannot progress a request without it.
Reasonable questions about a free offer
What is the catch?
There isn't a hidden one, but there is an obvious one: we think a real finding in your own system is a more persuasive argument than any case study, and some proportion of the organisations we do this for will hire us. That is the entire commercial logic. If you take the finding and go fix it yourself, that is a legitimate outcome and we will not chase you about it.
What if you don't find anything?
Then we tell you that plainly, and it costs you nothing. It happens — particularly with organisations that already test regularly. We will not manufacture a finding or dress an informational observation up as a Medium to hit the promise. If we find only Low or Informational issues, you get those instead, described accurately.
How much will you actually test?
Enough to find one solid finding, typically a few hours of tester time — not a full engagement. We stop once we have something worth reporting. This is a sample of how we work, not a substitute for a scoped test, and we will be clear in the write-up about what was and was not examined.
Will you exploit it or damage anything?
We confirm the finding is real and demonstrate impact, then stop. No destructive techniques, no denial of service, no data exfiltration beyond the minimum that evidences the issue, no lateral movement outside the authorised target. The rules of engagement are in the authorisation document and we hold to them.
Who sees the finding?
You, and the tester who found it. It is delivered over an encrypted channel, held encrypted at rest, and never published, shared or referenced without your written permission. See the privacy notice for retention detail.
Can I request this for a system I don't own?
No. If you believe a third party's system has a vulnerability, that is a responsible disclosure matter and not something we will test on your behalf — see our disclosure policy. If you are a supplier wanting to demonstrate value to a client, the client must be the one to authorise.
Prefer to talk it through first?
Book a scoping call. Free, forty-five minutes, no obligation to buy anything at the end.