Consultancy

Penetration testing

The only way to know how you'd hold up against an attacker is to have someone try. A certified ethical hacker does exactly that, then tells you plainly what to fix.

Talk to us about this
The problem

Scanners report weaknesses in theory. A skilled attacker chains them together, and it's only when someone actually tries that you find out which ones lead somewhere.

Customers, insurers and tenders increasingly ask for evidence of recent testing, and a vulnerability scan often isn't enough.

What we can do
  • External testing of your internet-facing systems: firewalls, remote access, email and anything else exposed online
  • Internal testing: what an attacker, or an insider, could reach once inside your network
  • Web application testing of your websites, portals and online forms
  • Wi-Fi testing, including guest network separation and unauthorised access points
  • Goals and rules of engagement agreed with you in writing before any testing starts
  • A plain-English report with an executive summary, every finding ranked by risk, and clear steps to fix it
  • A retest of what you have fixed, to confirm the holes are closed
Who it's for

Businesses asked for a penetration test by customers, insurers or tenders, businesses that have made a significant change such as a new system, office or website, and anyone who wants to know how their defences hold up in practice.

How it's charged

Work is charged at our standard day rate. We agree the scope and the number of days with you before anything starts, so there are no surprises, and it's invoiced separately from any monthly services.

How it works
  1. ScopeAgree what will be tested, when, and anything to avoid, with written authorisation before we start.
  2. TestHands-on testing using the same techniques as real attackers, carefully controlled to avoid disrupting your business.
  3. ReportWhat we found, how serious it is and how to fix it, with a walkthrough call to go through it together.
  4. RetestOnce you have made the fixes, we check them again.
Who does the work

Testing is carried out personally by Andy Martin, a Certified Ethical Hacker (CEH) who spent 20 years at Sophos. You deal with the person doing the testing from scoping through to retest.

Questions
A common rule of thumb is at least once a year, and after any significant change such as a new system, an office move or a new website.
Tests are planned with you, including timing and any systems to avoid, so they don't get in the way of normal work. Anything that could affect a live service is agreed with you first.
Our own testing is carried out by a CEH-certified tester, which isn't CREST or CHECK accreditation. If a tender requires one, we can arrange testing through Sophos Advisory Services instead, and check the testers' credentials meet it before you commit.
A scan is automated and lists known weaknesses. A penetration test is done by a person, who checks which weaknesses can actually be exploited and how far an attacker could get. Vulnerability management is a good ongoing companion to an annual test.

← Back to all consultancy services

Got a project in mind?

Tell us what you're trying to do and we'll tell you honestly whether we can help, how long it's likely to take, and what it would cost. No obligation.

Talk to us →
or
See every consultancy service →