We follow the attacker's path, not a checklist. Scanners find the obvious; people find broken access control, flawed business logic and weaknesses that matter only together.

Every finding comes with evidence, the reason it matters and a fix your developers can act on. After you fix it, we re-test, so the report ends with what is closed.

Scope, dates and rules of engagement are agreed in writing first. We test only what you authorise, and we keep your data to the minimum.

What we do

Four ways to test your defences

Start with the platform, free by invitation until 31 March 2027 (tests included), or ask for people: human-led testing and consulting are paid engagements, quoted on scope, and purple team exercises are being launched.

Free until 31 Mar 2027

PTaaS: penetration testing as a service

Request tests and follow findings and fixes in one place. By invitation; free, tests included, until 31 March 2027.

Learn more Paid · on quote

Human-led penetration testing

Manual testing supported by tools, for web applications, APIs and the infrastructure behind them. Results explained in plain language.

Learn more Paid · on quote

Security consulting

Help to prioritise findings, plan the fixes and prepare for customer reviews and audits.

Learn more Being launched

Purple team exercises

Simulated attack techniques run with your defenders watching, so you learn what was detected, how fast and what is missing.

Learn more
The foundation of all four

Continuous improvement

A recurring engagement: re-tests, new tests when your system changes, and a short roadmap of what to improve next.

Learn more

How we work

We test only what you authorise, when you authorise it. Scope and rules of engagement are written down first.

Authorisation first

Findings are written for the people who must fix them: evidence, impact and the smallest sensible change.

Reports that get used

We say what we are sure of and what we are not. A finding is either confirmed or marked as a lead.

Honest about certainty

We keep your data to the minimum and delete it when the work ends. Nothing leaves the engagement.

Minimal data

Good questions

Penetration testing as a service. Instead of one test and one PDF a year, you have a platform where you ask for tests, see findings as they are confirmed, and track fixes and re-tests.

We are opening the platform gradually, so each early customer gets real attention while we learn what works. Leave a request and tell us what you would like tested. We reply personally.

Until 31 March 2027, PTaaS is free for invited customers: the platform and the tests run on it. After that date, early customers get a discount. Human-led penetration tests and security consulting are paid engagements. Purple team exercises are being launched: send us a request and we will get back to you. We agree scope and price with you in writing before starting, and nothing renews automatically.

A scan runs automated checks and lists possible problems. A penetration test adds a person who decides which problems are real, chains them together and shows what an attacker could reach. We use both and say which is which.

The request form stores what you type, with the free-text fields encrypted, only to reply to you. It is deleted automatically after 12 months unless we start working together. You can ask to see, correct or delete it at any time. See the Privacy Notice.