Penetration testing services · Europe & US

Penetration testing that shows what an attacker could exploit

Manual, scoped tests with proof for every finding. One report for your board, one for your developers, and a retest once you’ve fixed things.

Request a scoping call What’s in the report

Every finding validated by hand before it reaches your report.

What we test

01 · Choose your test

Pick a target, or a compliance driver

Every test we run, plus pricing and a sample report. We agree the scope with you before any testing starts.

By target

Network

Perimeter, internal and Active Directory

Web application

OWASP, business logic and access control

AI & LLM

Prompt injection, agents, data leakage

By compliance driver

SOC 2 ISO 27001 PCI DSS NIS2 DORA & TLPT

See pricing See a sample report

02 · Approach

Choose how much testers know going in

We match the approach to your risk, your regulator and what you want to learn.

Knowledge shared: none

Black boxMost common

Simulates an outside attacker

Testers start with no inside knowledge and see only what an outsider can reach.

Best for: perimeter, web apps and internet-facing assets

Knowledge shared: a user’s access

Grey box

Simulates a compromised account

Testers start from a user login, the usual first step in a ransomware attack.

Best for: internal networks, Active Directory and ransomware paths

Knowledge shared: everything

White box

Full visibility

You share architecture and source code for the deepest review of critical systems.

Best for: critical applications and secure development

Discuss your approach

03 · The report

What’s in the report

Two layers: one for management, one for the people fixing things.

1Executive summaryBusiness risk in plain language
2Risk overviewFindings ranked by severity and impact
3FindingsEach with a CVSS score and business context
4Proof of conceptEvidence of what an attacker could reach
5RemediationClear steps, in priority order
6Compliance mappingReferences for NIS2, DORA, ISO 27001 and PCI DSS

After delivery: a developer walkthrough, a management briefing, and a retest report with attestation letter on request.

Request a scoping call

04 · Engagement

First call to final report in 3–4 weeks

Typical for a targeted test. Working to an audit or board date? We plan backwards from it.

Days 1–3Week 1Weeks 2–3Weeks 3–4After delivery

Q-SEC

Scoping call, NDA, rules of engagement

Reconnaissance and attack surface mapping

Exploitation and proof of concept

Report writing and QA review

Retest on request, remediation Q&A

Your team

Approve scope, share access

Minimal involvement

On standby for critical findings

Executive briefing, developer walkthrough

Fix, then sign off the retest

We report critical findings straight away. Your contact hears from us as soon as we confirm one.

Plan your test dates

05 · Questions

Penetration testing FAQ

Request a scoping call

More detail in our penetration testing knowledge base.

How much does a penetration test cost?

It depends on scope: how many applications, IP ranges and environments, and which approach (black, grey or white box). Tell us what you need tested and we'll quote after a short scoping call.

How long does a penetration test take?

A targeted test typically runs 2–4 weeks depending on scope, and 3–4 weeks from first call to final report. We can plan around an audit or board deadline.

What's the difference between a vulnerability scan and a penetration test?

A scan lists known weaknesses. A penetration test shows which of them an attacker can exploit, in what order, and what they would reach. We validate each finding by hand.

Does ISO 27001 require penetration testing?

Not by name. Annex A controls 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance) need evidence that technical controls work, and a penetration test with tracked remediation is the usual way to show it.

How often does PCI DSS require penetration testing?

Requirement 11.4 calls for external and internal penetration tests at least every 12 months and after significant changes, plus segmentation testing. Service providers must test segmentation every six months. See our PCI DSS penetration testing playbook.

What does DORA require for penetration testing?

Articles 24–27 require financial entities to run a digital operational resilience testing programme. Significant entities must also run threat-led penetration testing (TLPT) at least every three years.

Will testing disrupt our systems?

Testing runs within agreed windows, and proof-of-concept exploitation is safe and non-destructive. If we confirm a critical vulnerability, we tell your contact straight away.

Scoping call