Penetration testing, arranged and followed through
A penetration test is a skilled specialist trying to break into your systems the way an attacker would. We don't mark our own homework: we arrange the test with an independent specialist firm, coordinate it with you, then fix what they find and get it retested.
Penetration testing & remediation for small and medium businesses
Penetration tests often get commissioned because a large client, a tender or an insurer asks for one. The report then arrives as a sixty-page PDF full of severity ratings and technical detail, and sits in an inbox because nobody has the time or skills to act on it. The test has cost real money and the weaknesses it found are still there. The value of a penetration test is in the fixing afterwards, not the document.
We handle the whole cycle. First we help you decide what should be tested, whether your internet-facing systems, your internal network, your Microsoft 365 setup, a web application or your Wi-Fi, and how deep the test should go for your size and risk. Then we arrange the work with an independent testing specialist, agree the scope and timing in writing and make sure staff, suppliers and hosting providers know what to expect so nobody mistakes the test for a real attack.
When the report comes back, we translate it into a plan. Each finding is assigned an owner, a fix and a date. We do the remediation work on the systems we look after, and coordinate with your software vendors or web developers for anything outside our hands. Once the fixes are in, the tester checks them again, and you get a closing summary that shows what was found and what was done, which is usually what the client or insurer really wanted.
What's included
Scoping help
A conversation about what to test and why, so you pay for a test that matches your risks rather than a generic package.
Independent tester
The test itself is carried out by an independent specialist firm, so the people checking the systems are not the people who built them.
Coordination
Dates, test windows, permissions and notifications to staff, hosting providers and software vendors handled so the test runs smoothly.
Report translation
Each finding explained in plain English, with what it means for your business and how urgently it needs attention.
Remediation plan
A tracked list of fixes with owners and target dates, shared with you so progress is visible rather than assumed.
Fixing the findings
Updates, configuration changes, firewall rules and access changes carried out by us on the systems we manage.
Third-party follow-up
Findings in websites, line-of-business software or hosted services passed to the right vendor with enough detail for them to act.
Retest and summary
A retest of the fixed issues by the tester, plus a short closing summary for clients, auditors or insurers.
Who is penetration testing for?
A penetration test makes sense when:
- A client, tender or contract requires evidence of independent security testing
- You run a customer portal, online booking system or web app holding personal data
- You have made big changes to your network or moved systems to the cloud
- Your insurer or auditor has asked when you were last tested
- You already have a past test report with findings nobody has dealt with
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkPenetration testing & remediation questions
Do you do the penetration testing yourselves?
No. We arrange it with an independent specialist and coordinate it. Keeping the testing separate from the people who manage your systems gives a more honest result and is what most clients and auditors expect.
What is the difference between a scan and a penetration test?
A vulnerability scan is automated and checks for known weaknesses. A penetration test is a person combining weaknesses, misconfigurations and clever tricks to see how far they can actually get. Scans run often; tests are usually yearly or after major changes.
Will the test disrupt our business?
Tests are planned to avoid disruption, and the scope sets out what the tester may and may not do. Riskier activities can be scheduled out of hours. We let the relevant people know in advance so a test is not mistaken for a real incident.
How much does a penetration test cost?
It depends on the scope and is set by the testing firm. We get a written quote for the test and quote our own coordination and remediation work in writing first, so you see the full cost before agreeing.
Should we fix the basics before testing?
Usually yes. If you know multi-factor sign-in is missing or systems are unpatched, fixing that first means the test finds the less obvious problems you could not have found yourself, which is better value.
Can you help with a report we already have?
Yes. Send us the report and we will review it, explain the findings and quote the remediation in writing. Work on systems already under one of our plans is often covered by that plan.
How often should we test?
Many businesses test yearly and after significant changes such as a new website, a cloud migration or a new office network. Your client contracts or insurer may set their own requirement.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security