Assess
A scan says maybe. A test proves it.
A penetration test shows how a weakness could become a business problem. Focus the work on the systems, data and decisions that matter to your organisation.
Check whether sign-in, permissions and business workflows protect your users and their data before a release.
Give procurement and security reviewers evidence of what was tested, what was found and how you responded.
Understand whether new services, remote access or network changes have opened a route into sensitive systems.
The scope follows your business risk. We agree the systems, test depth and deliverables before you commit.
Start with an application or network. We define the assets, access and boundaries with you, so the proposal makes clear what is covered.
Can someone access another user’s data or exceed their permissions?
Which exposed systems could give an attacker a way into your organisation?
How far could an attacker move from a compromised account or device?
Automated tools help identify potential weaknesses. Manual testing checks whether they are exploitable, connects related findings and examines the workflows a scanner cannot understand.
Web and API testing draws on the relevant parts of OWASP WSTG and OWASP API Security guidance.
Mobile applications and cloud configuration reviews are scoped separately. Social engineering, denial-of-service testing and goal-based adversary simulation are outside this service.
Evidence for your engineers. Context for your decision-makers. A practical route from a finding to a verified fix.
From agreeing the scope to checking the fixes, you know what happens next and what your team receives.
We agree the scope, how testing will run and what you will receive, in a written proposal.
We use tools and manual checks to find exploitable weaknesses within the authorised scope.
We explain the risk and give your team practical steps to fix it.
Once your team has made changes, we check the agreed findings within your re-test window.
Before testing begins, we agree written authorisation, permitted techniques, testing windows, stop conditions, an escalation contact and how evidence will be handled.
Need a wider view? Explore our security assessment.We quote for your scope: the applications, user roles, integrations and network assets to be tested. Send a short outline and any deadline. We agree the price and deliverables before work starts.
It depends on scope and access. Your proposal sets the testing dates, report date and re-test window. Tell us about any launch or customer deadline so we can check availability.
Where the scope and operating conditions allow it. We agree permitted techniques, testing windows, stop conditions and an escalation contact first, and discuss the risk of disruption before authorisation.
Both can be appropriate. An unauthenticated test looks at what an external attacker can reach. Authenticated testing checks permissions and workflows from agreed user roles. For internal networks, we agree the starting foothold. Your proposal explains the approach and the access needed.
We agree confidentiality, evidence collection, secure transfer and retention arrangements before testing. Where practical, we use test data and collect only what is needed to demonstrate a finding. Tell us about your information-handling requirements during scoping so they can be included in the engagement.
Yes, for the agreed findings within the window in your proposal. We verify the fixes and document the result. New functionality or a changed architecture needs a new scope.
Share the requirement before booking, including any required accreditation or report format. We check whether we can meet it. A test provides evidence for its scope; it does not certify your organisation or guarantee every weakness has been found.
A test examines a defined application or network for exploitable weaknesses. The assessment gives a broader view of security posture and priorities. Tell us what decision you need to make if you are unsure where to start.
Tell us what you want tested and any deadline. We’ll help define the work and come back with a proposal.
contact@redvault.co.uk