Not sure what you need? Start here.
Answer four questions and get a straight recommendation in about two minutes. Or compare every service in plain English below.
Every service in one sentence.
No jargon. Open any service for who it's for, what's included and the technical detail.
Penetration Testing
A time-boxed, authorised attack on your systems by people who think like adversaries, proving what could really be reached and how to stop it.
Web Application Pen Testing
Deep testing of one web application and its APIs, including the business-logic flaws that automated scanners can't see.
Internal / External Network Pen Testing
We test how far an attacker gets from the internet, and from inside your network, to the systems that matter most.
Vulnerability Assessment
A broad scan of everything you expose, with every serious result checked by a person, so you know what's weak before an attacker does.
AI Penetration Testing
We attack your AI features the way a real adversary would: tricking the model, poisoning what it reads, and abusing the tools it can use.
ISO/IEC 42001 Readiness
We help you set up the AI management system in ISO/IEC 42001, so your AI is governed, documented and ready for certification.
Security Risk Assessment
A structured look at your whole organisation's security risks, ranked so leadership knows what to fund first.
ISO/IEC 27001 Readiness
We help you build the information-security management system an ISO 27001 auditor certifies, so it works in practice and passes.
HIPAA Assessment
A check of how you protect US patient health information against the HIPAA Security Rule, with a clear fix list.
Compliance Audits
An independent check that your controls meet the frameworks you answer to, so you find gaps before an official auditor does.
This or that?
Vulnerability assessment or penetration test?
Never been tested? Start with an assessment. Asked for a report by a customer? You need a pen test.
Read morePenetration test or red team?
Do pen testing first. A red team is worth it once the obvious gaps are fixed.
Read moreISO 27001 or ISO 42001?
Most firms need 27001 first. Add 42001 when customers or regulators ask how your AI is governed.
Read moreRisk assessment or compliance audit?
Planning and budgeting? Risk assessment. An audit date on the calendar? Compliance audit.
Read moreWhat people ask first.
How do I know if my company needs cybersecurity testing?
If customers send you security questionnaires, you handle personal, payment or health data, you ship software people log in to, or you've never had an outside test, you will benefit from one. The 2-minute check above points you to the right starting service.
What's the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment finds and ranks weaknesses across everything you expose. A penetration test goes further and proves which of them an attacker could actually use, by safely exploiting them within an agreed scope.
Do I need ISO 27001 to sell to enterprise customers?
It isn't a legal requirement in most cases, but many enterprise buyers and tenders ask for it because it answers most security questions at once. If you're losing time on questionnaires or deals, ISO/IEC 27001 is usually worth it.
How much does a penetration test cost?
Every engagement is a fixed fee based on scope: how many applications, APIs and hosts, how many user roles, and how deep the testing goes. You get a written scope and fixed price within five business days of a 60-minute scoping call.
What if we're too small to need any of this?
Then we'll tell you. On the scoping call we recommend the smallest engagement that answers your question, and sometimes that's nothing yet. Our free field notes cover the basics you can put in place on your own.
Ask us. We'll tell you straight.
A 60-minute call, no obligation. If you don't need us yet, we'll say so.