The external network-layer penetration test provides a ‘real world’ understanding of your internet-facing environment and what could be exploited by threat actors. Conducted off-site, this test identifies weaknesses in the configuration of internet-facing system components and any security flaws due to missing patches or misconfigurations. External penetration testing can also be conducted against cloud-based infrastructure.

The internal network-layer penetration test provides a ‘real world’ understanding of how your environment looks and what could be exploited by threat actors. Typically conducted on-site, this test can also be performed remotely based on the scope. It identifies weaknesses in the configuration of internal system components such as firewalls, routers, switches, servers, desktops, laptops, tablet devices, etc., and any security flaws due to missing patches or misconfigurations. Internal penetration testing can also be conducted against cloud-based infrastructure.

Web application penetration testing is conducted from our secure data centre and aims to identify application layer vulnerabilities. The application undergoes both automated and manual tests to determine susceptibility to the Open Web Application Security Project (OWASP) top-10 list of application vulnerabilities. Further testing is available for specialist areas including the OWASP mobile top 10, SANS, NIST, or compliance framework-based testing. Web application penetration tests can also be conducted for internally facing web-based applications.

Web API penetration testing is conducted from our secure data centre and aims to identify vulnerabilities in web-based application programming interfaces. Generally RESTful or SOAP implementations used to securely exchange data between systems, APIs are tested using the OWASP API Security Project Framework. Internal APIs can also be tested.

In the modern world, organisations are pushing out mobile apps to clients and staff members—these apps pose a significant risk of data loss, making regular testing essential. We test features such as application sandboxing, mobile platform usage, data transmission and storage, authentication mechanisms, and cryptographic mechanisms. Mobile application testing is generally conducted against Apple iOS and Android platforms, with accommodations for other platforms as needed.

Wireless infrastructure tests are conducted on-site and cover internal, approved wireless network configuration and security, guest, third-party, or internet-only wireless network configuration and security, and identification of any unauthorised wireless devices. Our wireless infrastructure testing supports PCI DSS requirements.

Network segmentation tests ensure that sensitive business functions are isolated from other areas of the network. This testing ensures effective and appropriate isolation, enabling sensitive business functions to remain secure. Our network segmentation testing supports PCI DSS requirements.

Internal, external, and segmentation testing can be conducted against cloud-based infrastructure. Standard virtual machines, network security groups, and Docker-based microservices managed by Kubernetes can all be tested for vulnerabilities to ensure system configurations are correct and security patches are up-to-date.

Our comprehensive Red, Blue, and Purple Teaming services combine the strengths of offensive and defensive security approaches. Our Red Team simulates real-world attacks to identify vulnerabilities, while our Blue Team focuses on defending and improving your security posture. The Purple Team facilitates collaboration between the Red and Blue Teams, ensuring continuous improvement and adaptive security strategies. This integrated approach provides a thorough assessment of your security measures and enhances your organisation’s resilience against cyber threats.