Questions people actually ask before buying a pentest.

A penetration test is a time-boxed, authorised attempt to break into your systems the way a real attacker would, followed by a written account of what worked. It matters because it tells you which weaknesses are actually exploitable in your environment, rather than which ones a tool flagged as theoretically present.

Annually is the common baseline, and after any significant change to authentication, authorization, or your externally reachable surface. A test is a snapshot of one moment. If you rewrote your login flow last month, last year's report no longer describes your application.

Most attacks are not targeted. Automated scanning finds your systems because they are reachable, not because of what they contain. Your infrastructure has value as a foothold, a mail relay, a host for someone else's content, or a route into a customer with deeper pockets than you.

A scan compares what it can see against a list of known issues and produces output. A penetration test uses scanning as one input, then a person tries to exploit what was found, chains findings together, and tests the logic no scanner understands. If a report reads like tool output, you paid for a scan.

They answer different questions. A bounty gives broad, ongoing, unpredictable coverage from many researchers, paid per finding. A penetration test gives systematic, scoped coverage on an agreed schedule, finishing with a written deliverable you can hand to an auditor. Mature programmes run both.

Yes, and it is most of what we do. A three-person team means we can scope an engagement that fits a twelve-person company without pretending it needs an enterprise budget.

Request a scoping call. We will ask what you have built, what worries you, and what your constraints are, then propose a scope and a fixed price. Scoping calls are free and we do not require you to have answers ready.

Web applications, mobile applications on iOS and Android, APIs including REST, GraphQL and SOAP, internal and external networks, and Azure and AWS cloud environments. If what you have built does not fit neatly into one of those, describe it on a scoping call and we will tell you honestly whether we are the right firm for it.

Production gives the truest result, because pre-production environments often differ from production in configuration, data and integrations, which is where findings tend to hide. Where production testing is genuinely too risky, we test a pre-production environment that mirrors it and record the difference as a limitation in the report.

No. Denial of service is excluded from every engagement by default, because demonstrating it means causing an outage. If you need resilience testing, it is scoped separately, with its own controls and its own window.

It helps considerably and takes about thirty minutes. Walking us through the workflows and roles means we spend the engagement testing your business logic rather than reverse-engineering how the application is meant to be used.

Each finding gets a CVSS vector, a CWE classification, the affected endpoints or hosts, full reproduction steps, evidence, and remediation guidance written against your stack. Critical findings are reported immediately during the engagement rather than held until the report.

We do not implement fixes in your codebase. Testing a system we built would compromise the independence that makes the report worth having. We do give remediation guidance specific enough to act on, and we will talk your developers through any finding.

Testing and the written report typically take one to four weeks from the day testing starts, depending on the size of the application or network and the types of testing in scope. The dates are agreed in writing at scoping, so you know the delivery day before work begins. The retest is scheduled when you tell us remediation is done, any time within 60 days of the report.

Written authorisation, the in-scope targets, test accounts for each role, and a named technical contact. For white box work, repository access as well. We supply the authorisation template.

You get the report, then a walkthrough call where we go through the findings with whoever is going to fix them. That call is usually where the most value lands, because it is where the report stops being a document and becomes a work plan.

Once you have remediated, we test the reported findings again and issue a retest summary confirming what is closed and what is still open. One retest round of the original findings is included for eligible services. Request it within 60 calendar days of report delivery, and we run it within 10 business days of your request, with working access in place. Internal network and Active Directory retests are not included as standard. When required, they are scoped separately, with timing and any fees agreed in advance. In combined engagements, the included round covers findings from eligible services. It is the only way to know a fix actually worked rather than appeared to.

For eligible services, sixty days from the day the report is delivered to tell us remediation is complete; we then run the retest within 10 business days, with working access in place. Most teams are ready within four to eight weeks, which fits comfortably. If you need longer, tell us before the window closes and we will agree a date. A retest requested outside the window, or of anything beyond the reported findings, is quoted separately.

Yes. You may use the report internally and share it or its executive summary with your auditors, customers and insurers under confidentiality. The report is structured so the executive summary and grade can be shared with a non-technical audience without exposing reproduction steps, which is usually what a customer or auditor actually needs to see.

After significant change to authentication, authorization or your external surface, and otherwise annually. If you are shipping continuously, an annual test plus a smaller, focused test after major releases is a reasonable rhythm. That is new work and is quoted separately; the included retest covers the findings in your report.