A clear testing mandate
Systems, objectives, timing and permitted methods are agreed in writing before testing begins. Testing only covers systems you are authorised to have tested.
01 / PENETRATION TESTING
How far could an attacker
get?
A penetration test explores how weaknesses could be used in an attack. We agree the objectives and boundaries, test selected attack paths and explain what the findings mean for your business.
Request a quoteSUITABLE FOR
For businesses that want to investigate risk in selected systems, before a major launch or as part of planned security work.
01 / SCOPE AND DELIVERABLES
From insight to action.
Testing attack paths
Selected weaknesses are examined together to assess whether they could allow unauthorised access or other consequences. Depth and methods follow the agreed scope.
Findings that mean something
Reporting explains what was tested, which findings were confirmed and what they could mean for information and operations. The level of documentation is agreed in advance.
A basis for remediation
Priorities and recommended actions make the results useful for IT and management. Retesting after remediation can be agreed separately.
Scope, deliverables and pricing are tailored to the engagement. A penetration test is a snapshot within defined boundaries and cannot reveal every possible attack path.
HOW WE GET STARTED
Define the scope
We agree which systems, attack scenarios and testing methods the engagement will cover.
Test
Testing follows the mandate, with agreed contact points and stop conditions.
Prioritise
Findings inform practical actions. Follow-up and any retesting are agreed together.
02 / REGULATIONS AND DOCUMENTATION
Supporting your security work.
Our assessment of how the service can support your work. Applicable requirements depend on your organisation and how the service is used.
GDPR / privacy
Test findings can help assess whether technical security measures adequately protect personal data.
GDPR, including Article 32DORA
An agreed penetration test may form part of a risk-based testing programme. This service is not offered as DORA TLPT.
DORA: testing and trainingISO/IEC 27001
Findings and follow-up can inform the organisation’s risk treatment and improvement work.
ISO on the standardThe service is not a certification or a guarantee of full compliance. The regulatory information is general guidance, not legal advice. Sources checked on 18 September 2026.
Useful to know before we start.
How is this different from a vulnerability assessment?
A vulnerability assessment provides a broader view of technical weaknesses and may include controlled testing of selected findings. A penetration test puts greater emphasis on specific attack paths, connections and consequences. The agreed scope determines the depth.
Can production systems be tested?
This is assessed for each engagement. The testing window, system load, contingency arrangements and limits on active testing must be agreed, particularly for systems essential to operations.
Is this a DORA TLPT test?
An ordinary penetration test is not a threat-led penetration test under DORA’s specific TLPT framework. TLPT applies to designated entities and has separate requirements for testing and testers.
NEXT STEP / A NO-OBLIGATION CONVERSATION
Discuss your penetration test
What would you like to test, and what do you want to learn? Do not include passwords or sensitive system details here.
We agree needs, scope and pricing before starting.
An enquiry carries no obligation to purchase.