Offensive security services
Eight testing disciplines, one methodology. Every engagement is manual, exploitation-led and delivered by a named tester — with a fixed price agreed before we start.
Choosing the right test
Typical durations assume a single target of moderate complexity. We confirm effort during scoping — these are planning figures, not quotes.
| Service | Best when | Typical effort | Key standards |
|---|---|---|---|
| Web application | You have a customer-facing app handling accounts, payments or sensitive records | 5–10 days | |
| API | Mobile or partner integrations expose business logic directly | 4–8 days | |
| Network — external | You need assurance on your internet-facing perimeter | 3–6 days | |
| Network — internal | You want to know what a phished employee could reach | 5–10 days | |
| Mobile application | Your iOS or Android app stores data or authenticates users on-device | 5–8 days | |
| Active Directory | Windows domain underpins access across the business | 5–8 days | |
| Cloud configuration | Infrastructure is on AWS, Azure or GCP and has grown organically | 4–7 days | |
| AI / LLM | You have shipped a model, agent or RAG feature to users | 4–8 days | |
| Red team | Your controls are mature and you want to test detection, not exposure | 3–6 weeks |
Not sure which you need? Most organisations testing for the first time should start with an external network test plus their primary web application. That combination covers the two routes an opportunistic attacker actually takes. Book a free scoping call and we will tell you honestly if you need less than you think.
What each engagement covers
Web application penetration testing
Authenticated and unauthenticated testing across every user role, covering injection, access control, session management, cryptographic storage and business logic abuse.
- Broken access control and privilege escalation between roles
- Injection: SQL, NoSQL, command, template and deserialisation
- Authentication, MFA bypass, session fixation and token handling
- Business logic — pricing, workflow sequencing, race conditions
API penetration testing
REST, GraphQL and gRPC surfaces tested against the OWASP API Top 10, with particular attention to object-level authorisation — the flaw that causes most real API breaches.
- Broken object and function level authorisation (BOLA / BFLA)
- Mass assignment and excessive data exposure in responses
- GraphQL introspection, batching abuse and query depth attacks
- Rate limiting, resource consumption and enumeration resistance
Network penetration testing
External perimeter testing, internal assumed-breach testing, or both. Internal engagements start from the position of a compromised workstation and work outward.
- Service enumeration, version analysis and exposure review
- Credential attacks, relay and lateral movement paths
- Segmentation validation for PCI-DSS and equivalent scoping
- Privilege escalation to domain or infrastructure administrator
Mobile application penetration testing
iOS and Android testing against OWASP MASVS, combining static review of the package with dynamic runtime analysis on instrumented devices.
- Insecure local storage, keychain and keystore misuse
- Transport security, certificate pinning and pinning bypass
- Runtime manipulation, hooking and anti-tamper effectiveness
- The backend API the app depends on, tested alongside
Active Directory security review
A structured review of the identity layer most organisations depend on and few have hardened, mapping the shortest realistic path from ordinary user to domain administrator.
- Kerberos attack surface — roasting, delegation, ticket abuse
- AD Certificate Services misconfiguration and escalation paths
- Group Policy, ACL and nested group rights analysis
- Administrative tiering and credential exposure review
Cloud configuration review
AWS, Azure and GCP environments assessed against CIS Benchmarks and provider guidance, with an emphasis on identity — the control plane that decides everything else.
- IAM roles, trust policies and privilege escalation chains
- Storage exposure, encryption posture and key management
- Network boundaries, security groups and peering
- Logging, retention and detection coverage
AI and LLM security testing
Testing for applications built on language models — chat interfaces, retrieval systems and tool-using agents — against the OWASP Top 10 for LLM Applications.
- Direct and indirect prompt injection, including via retrieved content
- Insecure output handling where model output reaches an interpreter
- Data leakage from context windows, embeddings and system prompts
- Agent tool abuse, excessive agency and permission boundaries
Red team operations
Goal-oriented adversary simulation against a defined objective, measuring whether your detection and response functions actually work under realistic conditions.
- Objective-based scenarios agreed with your leadership up front
- Detection and response measurement at every stage
- Purple team replay so your defenders learn from every step
- Suitable as preparation for TIBER-EU and CBEST engagements
The parts other firms charge extra for
Free retest
Remediated findings are retested and the report reissued at no cost, within six months of delivery.
Remediation session
A working call where your engineers can ask the tester directly how to fix each finding.
Dual reporting
A technical report and a separate executive summary, both included as standard.
Attestation letter
A signed letter confirming testing dates and scope, for customers and auditors who ask.
Get a fixed-price quote in two working days.
Tell us what you have built and we will tell you what is worth testing — including when the answer is less than you expected.