Loading page…
Technical practice
A scanner produces a list. An assessment produces a decision. We test your networks, applications and configurations, then report what an attacker could reach, what it would mean for the business, and what to fix first.
In this practice
+1 more service in this practice
What we usually find
Outcomes
Findings ranked by exploitability and business impact, so engineering effort goes where it reduces the most risk.
Where a vulnerability is confirmed exploitable, we demonstrate it safely — no theoretical severity ratings with nothing behind them.
A technical report your engineers can work from, and an executive summary that states residual risk in business terms.
Retesting confirms fixes actually resolved the issue, producing evidence you can put in front of an auditor or a customer.
What we deliver
Scoped individually or combined into a programme, depending on where you are starting from.
Authenticated and unauthenticated assessment of internal and external network estate, with false positives removed before you ever see the report.
Manual, objective-driven testing that chains findings the way an attacker would, rather than reporting them in isolation.
Testing against the OWASP Top 10 and beyond — authentication, session handling, access control, injection, business logic and API surface.
Review of operating systems, databases, network devices and cloud services against hardening baselines and vendor guidance.
Architecture and segmentation review covering trust boundaries, exposed services, filtering rules and lateral movement paths.
Manual review supported by static analysis, focused on authentication, authorisation, input handling, secrets management and cryptographic use.
Deliverables
Named outputs, not a workstream description. Every item below is produced by this practice and can be reviewed in draft before it is finalised.
A non-technical account of exposure, business impact and recommended priority, written for a board or audit committee audience.
Each finding with affected asset, severity and CVSS rating, reproduction detail, evidence of exploitability, and specific remediation guidance.
Findings sequenced by risk and effort, with suggested owners and target dates, so remediation can be tracked as work rather than as a document.
What was tested, from what position, over what window, and what was explicitly out of scope — the record an auditor or enterprise customer will ask for.
Verification that remediated findings are actually closed, issued as a separate signed record suitable for sharing with third parties.
Our approach
Each stage produces something you can review before the next one starts. No stage depends on trusting that the previous one went well.
Targets, methods, testing window, escalation contacts and authorisation agreed and signed before any activity begins.
Enumerate the attack surface as it exists, not as the asset inventory claims it exists.
Automated coverage combined with manual testing, with confirmed findings demonstrated safely and within agreed limits.
Each finding translated into what it would let an attacker do to your data, your services and your obligations.
Technical report, executive summary and a live session where your engineers can question the findings directly.
Guidance while fixes are built, then retesting to confirm and evidence closure.
SecureGRC · technology enablement
Assessment findings can be loaded into SecureGRC as risks and treatment actions with owners and due dates, so remediation is tracked in the same place as the rest of the risk programme.
Relevant platform capabilities
Common questions
Related practices
Next step
Tell us your current position, what has to be demonstrated and the date it is required by. You will receive a scoped approach with defined stages — not a generic proposal.