Most people picture a penetration test as someone in a hoodie typing furiously. The reality is a scoped, authorised project with a start, a finish and a report you can hand to your board. Here's how one runs.

1. Scoping and authorisation

We agree what's in scope: your external systems, your internal network, a web application, or all of them. We agree the goals, the rules (what's off limits, what hours, who to call), and you sign an authorisation. Nothing happens without it.

2. Reconnaissance

We map your footprint the way an attacker would: domains and subdomains, exposed services, the technologies you run, what your staff share publicly. It's surprising how much a business gives away.

3. Testing and exploitation

Automated tools find candidates; people prove them. We chain weaknesses together, a forgotten server here, a default password there, to show what an attacker could really reach. Anything destructive is agreed in advance or excluded.

4. Reporting

You get 2 documents: a management summary that says where you stand and what to do first, and a technical report with every finding, its severity, the evidence and the fix. No jargon in the first, plenty of detail in the second.

5. Retest

Once the fixes are in, we verify them and update the report. That updated report is what you show to the customer, insurer or auditor who asked.

How often?

At least annually, and after any big change. Pair it with regular vulnerability scanning in between and you'll know your weaknesses before anyone else does. Find out more about our penetration testing, or start with our 5-minute health check.