Independent Cyber Essentials, Cyber Essentials Plus and penetration testing for UK businesses. Find the weaknesses before an attacker does, with fixed-price scoping and plain-English reports.
Not sure what you need? Tell us what you're trying to achieve and we'll tell you which level makes sense.
Get certified to show customers you take the basics seriously, then test properly to find what a determined attacker would.
The UK government-backed scheme that covers the five controls stopping the majority of common attacks. We get you assessment-ready, then certify, without the jargon.
Everything an attacker can reach from the internet (your perimeter, exposed services, VPNs and cloud edges), probed the way a real adversary would.
What's covered →We model the breached laptop or rogue insider, then see how far that foothold spreads across your network, servers and Active Directory.
What's covered →Authenticated, role-aware testing of your apps and APIs against the OWASP Top 10 and the logic flaws scanners simply never find.
What's covered →A scanner hands you a list of issues. A penetration test shows you the story an attacker would tell: start with a single compromised user, and see how quickly that becomes control of everything.
This is exactly what an internal infrastructure test models. The path below is illustrative, not a real client, but every step is one we see in the wild.
See how internal testing worksOne employee's password, phished and reused elsewhere. We're in as a normal user, with nothing that looks out of place.
That user can open a file share they shouldn't. Inside is a setup script with an administrator password saved in plain text.
The password unlocks a server. We're no longer an ordinary user; we're a local administrator with room to work.
From that server we reach others, collecting credentials as we go, quietly spreading across the network.
One of those credentials owns the domain: every account, every machine, every file. Game over.
DOMAIN ADMINMost clients begin with certification and climb as their needs grow. Each step proves something the one before it couldn't.
Are the basic controls in place?
Self-assessment, verified by us. The credential customers, insurers and tenders increasingly expect.
Do those controls survive independent testing?
A hands-on audit of the same controls, checked from outside your team rather than taken on trust.
What could an attacker actually do?
External, internal and web application testing that goes looking for the way in, not just a list of theoretical issues.
Are you still secure as things change?
Regular retesting, so new gaps surface on your schedule instead of an attacker's.
Security work has a reputation for being slow, opaque and full of surprises. We've built ours to be the opposite: clear scope, a fixed price up front, and a report you can actually act on.
A single point of contact runs your engagement end to end, so you're never re-explaining your environment to a stranger.
Start with a free scoping callA short call to understand your environment. You leave with a fixed price and a clear plan, no obligation.
We agree dates that suit you, including out of hours, and confirm exactly what's in and out of scope in writing.
An experienced tester runs the assessment, keeping you posted and flagging anything critical the moment it's found.
A plain-English report: an exec summary anyone can follow, plus prioritised, reproducible findings and fixes for your engineers.
We walk you through the findings, answer your team's questions, and re-test the fixes, at no extra cost.
They work hard to keep you secure, and that's exactly why the check should come from outside. Independent testing isn't a challenge to your team, it's how you prove the controls hold up. We test from the attacker's side, so a pass actually means something.
Our lead tester is a UK Cyber Security Council registered Principal (PriCSP) for Security Testing. And we hold ourselves to the same bar we set for clients: we're Cyber Essentials Plus and IASME Cyber Assurance certified. Tap a badge to check the live certificate.
UK Cyber Security CouncilPrincipal (PriCSP) · Security Testing
Cyber Essentials PlusCertified · view certificateVerify 
IASME Cyber AssuranceLevel 1 · view certificateVerify Cyber Essentials certifies that you have five fundamental controls in place: it's a baseline and a trust signal for customers and tenders. A penetration test goes much further: a qualified tester actively tries to break in, the way a real attacker would, and tells you exactly what they found. Most organisations benefit from both.
An experienced, senior tester runs your engagement from scoping to report, with no hand-off to a junior halfway through. Infrastructure testing is delivered to a recognised methodology by a tester holding The Cyber Scheme's Team Leader qualification for infrastructure testing, which is recognised by the NCSC against UK government testing standards; web application testing follows the OWASP methodology. The point isn't the badges: it's that the work is done thoroughly and by hand, not left to a scanner.
Yes. External testing looks at everything reachable from the internet; internal testing assumes an attacker already has a foothold and measures how far it spreads. They answer different questions, and many engagements include both alongside a web application test.
Most tests run over a few days and can be scheduled out of hours. We agree the rules of engagement in writing first, work to a careful methodology, and stay in contact throughout, so there are no surprises for your team.
Once we've scoped the work, the quote is fixed. Remediation re-tests and the post-report walkthrough are included. If the scope genuinely changes, we'll talk it through before any cost does.
A couple of details is all we need to get started. We'll come back within one working day with next steps, usually a short, no-obligation scoping call.