Penetration testing that ends arguments — not scanner exports.

External penetration testing answers the question every customer security review and insurance renewal is really asking: what could a competent attacker reach from the internet today? We attack your internet-facing surface — web applications, exposed APIs, infrastructure, and the third-party integrations attached to them — starting from OSINT and asset discovery, because the assets you have forgotten about are usually the ones that matter. It is the most common starting point, and the baseline most external obligations expect.

Internal penetration testing is an assumed-breach engagement: we start from a foothold inside the network and measure how far an attacker moves before someone stops them. The objective is usually Domain Admin, a privileged data store, or a business-critical workload. The output is a quantified view of internal blast radius and ransomware exposure — the kind of figure a board and a CFO can actually use.

Not every penetration testing company delivers the same thing. What separates a useful test from a scanner export is senior practitioners doing the work, reproducible evidence for every finding, severity scored against business impact, and a remediation plan your team can act on. Before you sign, ask who will actually run the test, how scope is set, and what the report contains.

We don’t invent methodology — we use, cite, and extend recognised standards, and we tell you which ones before the engagement starts. Every test runs on the same six-stage lifecycle, so you always know what happens next.

Scoping. We define objectives, assets, threat model, rules of engagement, deliverables, and a pricing band, ending in a signed Statement of Work.

Kickoff. We confirm rules of engagement, contacts, escalation paths, schedule, secure communication channels, and access in a single 60-minute call.

Execution. The testing itself, scoped to the asset class. Critical findings are escalated to you within four working hours of discovery — never held back until the report.

Reporting. We produce the three-artifact Engagement Brief and put it through internal peer review before you see it.

Debrief. Two sessions — a technical walkthrough with your engineers and an executive debrief with leadership — plus Q&A on the action plan.

Closure and optional retest. The action plan goes to its owners, and you can elect a focused retest of critical and high findings with an updated attestation.

The standards base depends on the asset: PTES and MITRE ATT&CK for external and internal work; the OWASP Web Security Testing Guide and API Security Top 10 for web and APIs; OWASP MASVS for mobile; the MITRE ATT&CK Cloud matrix and CIS Benchmarks for cloud.

We price engagements fixed, banded by scope — not by the day. For an external or internal test, the band is set by the number of in-scope assets and the complexity of the environment; for web and API work, by the number of roles, endpoints, and the business-logic complexity of the application. We give you the band during scoping, before you sign anything, so there are no day-rate surprises.

A few things we deliberately don’t do: we don’t sell day rates, we don’t resell or upsell tooling, and we take no vendor commissions — so the test is sized to answer your actual question, not the largest engagement we could justify. If you have a budget you’re working within, tell us during scoping and we’ll be straight about what it covers.