Security testing
Penetration testing and vulnerability management
We test agreed systems for exploitable weaknesses and document the conditions, evidence, business impact, and remediation for each finding. Engagements can cover external or internal networks, web applications, Active Directory, Entra ID, and Microsoft 365; the written scope identifies the actual targets and methods.
Vulnerability management provides recurring discovery, validation, prioritization, assigned remediation, and closure tracking. Scan results are reviewed in context. A scanner finding is not treated as a demonstrated exploit, and a completed change is not treated as a verified fix until the agreed checks pass.
Authorized testing of external and internal networks, web applications, Active Directory, Entra ID, and Microsoft 365. Recurring vulnerability review, remediation tracking, and retesting are scoped separately.
Common starting points
Problems and projects we take on
- An application, network, or identity environment needs an authorized penetration test
- A launch, acquisition, customer requirement, or material change calls for security validation
- Existing scanner results need validation, prioritization, and assigned remediation
- Active Directory, Entra ID, or Microsoft 365 access paths and configuration need review
- Completed remediation needs an independent retest and documented closure
- A recurring vulnerability program needs owners, target dates, exception handling, and reporting
What we do
What we can handle
The written scope identifies which activities and systems are included.
Authorization and rules of engagement
Before active testing, agree signed authorization, IP addresses and domains, asset ownership, allowed methods, test windows, emergency contacts, stop conditions, evidence handling, and exclusions. Third-party approval is required where applicable.
External and internal testing
Review agreed exposed services and internal access paths. Validate findings using the least disruptive method that can establish impact within the authorized scope.
Web applications and identity
Assess agreed authentication, authorization, session, and access-control scenarios. Active Directory, Entra ID, and Microsoft 365 work is limited to the approved tenants, accounts, roles, and methods.
Methodology and coverage
Select applicable PTES, OWASP Web Security Testing Guide, and NIST SP 800-115 practices for the engagement. The report records coverage and limitations; these references do not imply certification or exhaustive coverage.
Recurring vulnerability management
Set the scan and review cadence, validate findings, remove duplicates, assign owners and remediation targets, track exceptions, and report unresolved exposure. SLA targets are agreed for the environment.
Reporting and retesting
Provide an executive summary and technical findings with reproducible evidence, severity reasoning, remediation, and verification criteria. Agree the retest window and record verified fixes, residual risk, and items not retested.
What you receive
Deliverables
You receive the completed work, the agreed documentation, and a clear record of what changed, how it works, and what happens next.
- Scope and rules of engagement
- Asset and coverage record
- Executive summary
- Technical findings with evidence and severity rationale
- Prioritized remediation plan with owners and target dates
- Evidence-handling and limitations record
- Retest results for the agreed scope
- Recurring vulnerability register and reporting when included
See the work
Sample penetration test report
An eight-page sample report for Alderwick Industrial Supply, with an executive summary, severity ratings, technical findings, and a remediation plan.
Scope and limitations
Active testing begins only after signed authorization and rules of engagement. Denial of service, phishing, credential spraying, persistence, and third-party systems are excluded unless explicitly agreed. A report reflects the systems and time window tested; it is not a guarantee of security or a compliance certification.
Request a testing scope
Include the asset types, approximate counts, ownership, objectives, timing, and any customer requirements. Credentials and sensitive findings are exchanged through an agreed secure channel after scoping.