CREST-Accredited Penetration Testing Services

Pen testing, also known as penetration testing or ethical hacking, is an authorised attempt to safely get into your IT systems in order to see if they are vulnerable to attack. The experts carrying out these tests will look for flaws in your systems that cyber criminals could exploit. We have a whole explainer blog on this if you want to read more.

If you’re unsure about how secure your systems are, a pentest is a great way to gain insights into any vulnerabilities before it’s too late. It may also be required for you to carry out a pen test to achieve or maintain compliance with security standards like PCI DSS.

Pen testing should be carried out under strict rules of engagement, agreed by both parties. If carried out incorrectly, pen tests can cause a number of issues – similar to if your systems were actually hacked, and may well be illegal. Because of this, it’s imperative that you use qualified and experienced professionals, as they should ensure there are approved agreements in place to allow pen test activities, as well as ensuring that no damage is caused to your systems during the pen testing activities. It’s also important that your team knows that a penetration test is going to take place. This allows them to prepare by, for example, whitelisting the IP addresses and other sources of the staged attack environment. See our blog on preparation for a pen test here: Penetration testing – what we need to know from you and why.

Penetration testing goes further than vulnerability scans, as it doesn’t just look and report vulnerabilities, but also investigates weaknesses to see the level of access a hacker could obtain. Additionally, a penetration test is performed manually by a security expert who will utilise their experience and a variety of manual tools. Vulnerability scans are usually automated.

Internal pen testing looks for vulnerabilities that could be exploited by an employee with access to the organisation’s internal network. It will give the tester the same access as that which someone inside the organisation would have. It may also include verifying any segmented networks within the internal network are configured correctly. Internal pen tests will help you understand how much damage, for example, a malicious employee could cause, as well as meet compliance obligations. External testing looks for vulnerabilities that attackers could exploit on public-facing networks like email, your website, file-sharing systems, messaging platforms and any hosted FTP servers. External pen tests can help you understand the damage an external hacker could cause.

It’s hard to give a typical cost, since pen tests need to be tailored to your individual needs and circumstances. However, a pentesting project with reporting will normally cost from around £3,000 (+VAT).

Before your pentest, you should ask yourself some important questions. What is your motivation? What are your compliance requirements? Do you want to know for your own peace of mind or do you want to elevate your security posture? Do you need to increase overall security awareness in the business?

Your network diagram needs to be up-to-date and you should have a data-flow map for your environment. You should also have a list of active ports on your perimeter security device, which should be as current as possible, as well as what services should be open through your firewall or available through your web application. This isn’t necessarily information that your pentester will need, but it helps to be prepared should they run into an issue or if they require more information. 

Technically speaking, yes. But not all hackers are the same, and hacking doesn’t always imply bad intentions. Pentesters hack ethically, and are also known as ‘white hat’ hackers. Once authorised, they are allowed to attempt to exploit a company’s system vulnerabilities to highlight where the business can improve its cyber security. A ‘grey hat’ hacker may hack into a business’s network without being asked. They may ask for money in return for highlighting where the business’s cyber security can be improved, or they may threaten to expose sensitive data if they aren’t paid. A ‘black hat’ hacker is a malicious actor who breaks into computer networks with malicious intent. They harm a business rather than help.