How secure is your business against a real attack?
A penetration test is an authorised attack on your systems by people who know exactly how criminals work. We find and prove the weaknesses that matter before someone else does, then hand you a plan to fix them. Delivered by the CRIBB Cyber Security team.
Delivered by CRIBB Cyber Security, the assurance arm of the Clipeum group
Tests for every part of your attack surface
External penetration test
Your internet-facing systems, tested the way an outside attacker would: firewalls, VPNs, email, remote access and anything exposed.
Internal penetration test
What could someone do once inside: a rogue employee, a compromised laptop or a visitor on the Wi-Fi. How far can they get?
Web application test
Websites, portals and APIs tested for injection, broken authentication, access control flaws and the rest of the OWASP list.
Code review
Source code reviewed for insecure logic and weaknesses before they reach production.
Red team assessment
A goal-based, quiet attack that tests your detection and response, including social engineering. For mature security programmes.
IT Health Check (ITHC)
The formal assessment UK government systems and suppliers need, aligned to Cyber Essentials and government security classifications.
What actually happens
Scope
We agree what's in and out, the goals, the rules of engagement and when. You sign the authorisation.
Reconnaissance
We map your footprint: domains, services, technologies, people, anything an attacker would find.
Test and exploit
Automated tooling first, then hands-on testing to prove which weaknesses are really exploitable, safely.
Report
A management summary for the board and a technical report for whoever fixes it, with every finding rated and prioritised.
Retest
Once you've fixed the findings, we verify them and update the report so you can show it to whoever asked.
Black, grey or white box?
Black box
We get a company name or a URL and nothing else, and attack as an outsider would. The most realistic view of external risk.
Grey box
We get some information, such as a user login, for a more focused test in less time. Ideal for web applications with logged-in areas.
White box
We get architecture, credentials and sometimes source code. The deepest assurance of your application and infrastructure logic.
Penetration testing questions
How often should we run a penetration test?
How long does it take?
Will it break anything?
What's the difference between a pen test and a vulnerability scan?
Who does the testing?
Keep exploring
Talk to a person who knows IT, not a script.
Tell us what's frustrating you about your IT or security. We'll give you an honest view of what we'd change, whether or not you work with us.