--- title: 'Penetration Testing UK | CEH-Certified Tester' url: 'https://triplepoint.org.uk/consultancy/penetration-testing' markdown: 'https://triplepoint.org.uk/consultancy/penetration-testing.md' date: '2026-10-15' description: 'Penetration testing for UK small businesses by a CEH-certified ethical hacker with 20 years at Sophos: external, internal, web application and Wi-Fi testing, with a plain-English report and retest.' --- # Penetration Testing UK | CEH-Certified Tester The problemScanners report weaknesses in theory. A skilled attacker chains them together, and it's only when someone actually tries that you find out which ones lead somewhere. Customers, insurers and tenders increasingly ask for evidence of recent testing, and a vulnerability scan often isn't enough. What we can do- External testing of your internet-facing systems: firewalls, remote access, email and anything else exposed online - Internal testing: what an attacker, or an insider, could reach once inside your network - Web application testing of your websites, portals and online forms - Wi-Fi testing, including guest network separation and unauthorised access points - Goals and rules of engagement agreed with you in writing before any testing starts - A plain-English report with an executive summary, every finding ranked by risk, and clear steps to fix it - A retest of what you have fixed, to confirm the holes are closed Who it's forBusinesses asked for a penetration test by customers, insurers or tenders, businesses that have made a significant change such as a new system, office or website, and anyone who wants to know how their defences hold up in practice. How it's chargedWork is charged at our standard day rate. We agree the scope and the number of days with you before anything starts, so there are no surprises, and it's invoiced separately from any monthly services. How it works1. **Scope**Agree what will be tested, when, and anything to avoid, with written authorisation before we start. 2. **Test**Hands-on testing using the same techniques as real attackers, carefully controlled to avoid disrupting your business. 3. **Report**What we found, how serious it is and how to fix it, with a walkthrough call to go through it together. 4. **Retest**Once you have made the fixes, we check them again. Who does the workTesting is carried out personally by Andy Martin, a Certified Ethical Hacker (CEH) who spent 20 years at Sophos. You deal with the person doing the testing from scoping through to retest. Questions How often should we test?+A common rule of thumb is at least once a year, and after any significant change such as a new system, an office move or a new website. Will testing disrupt our business?+Tests are planned with you, including timing and any systems to avoid, so they don't get in the way of normal work. Anything that could affect a live service is agreed with you first. Our tender requires a CREST or CHECK accredited tester. Can you help?+Our own testing is carried out by a CEH-certified tester, which isn't CREST or CHECK accreditation. If a tender requires one, we can arrange [testing through Sophos Advisory Services](https://triplepoint.org.uk/security/risk-and-assurance/security-testing) instead, and check the testers' credentials meet it before you commit. What's the difference between this and a vulnerability scan?+A scan is automated and lists known weaknesses. A penetration test is done by a person, who checks which weaknesses can actually be exploited and how far an attacker could get. [Vulnerability management](https://triplepoint.org.uk/security/risk-and-assurance/vulnerability-management) is a good ongoing companion to an annual test. [← Back to all consultancy services](https://triplepoint.org.uk/consultancy) ## Got a project in mind? Tell us what you're trying to do and we'll tell you honestly whether we can help, how long it's likely to take, and what it would cost. No obligation. [Talk to us →](https://triplepoint.org.uk/contact?about=Penetration%20testing) or [See every consultancy service →](https://triplepoint.org.uk/consultancy) --- ## Navigation - Parent: [IT & Cyber Security Consultancy UK | AI, Power Platform, Pen Testing](https://triplepoint.org.uk/consultancy.md) - Previous: [Power Automate & Power Apps Consultancy UK](https://triplepoint.org.uk/consultancy/power-platform.md)