Prove · Coming soon
Penetration testing and assurance
Authorised, scoped testing that shows what an attacker could do.
When this service is available, authorised testers will try to find and exploit weaknesses in the systems you choose, within agreed rules of engagement, and report what they found, how serious it is for your business and how to fix it. Testing is delivered by a specialist partner; Cyber Guys does not run an in-house testing team. This service is not yet available.
Register interest- Price
- Not available yet
- How you can engage us
- One-off project
- Delivered by
- A specialist partner
Who delivers this: Delivery will be through a specialist partner that you explicitly engage for the testing. The partner will be named in the scope before any work starts.
Who it is for
Businesses that need independent testing of applications, networks or cloud configuration for clients, tenders, insurers or their own assurance.
Scope
Only the assets, testing types and windows authorised in writing in the rules of engagement.
What is included
- Web application and API testing
- Internal and external network testing
- Cloud configuration review
- Microsoft 365 or Google Workspace tenant review
- Authorised social engineering, such as phishing or phone-based testing
- Secure code and architecture review
- Rules of engagement covering authorised assets, testing windows, exclusions and emergency contacts
- Findings with reproduction detail where appropriate, business impact and remediation guidance
- Retesting of fixed findings, where agreed in the scope
What is not included
- Work outside the agreed scope, which is quoted separately
- Testing any asset not authorised in writing
- Testing third-party systems without written permission from their owner
- Denial-of-service testing, unless explicitly agreed
- Fixing the findings, beyond coordinating remediation
- Certification of any kind
How delivery works
- 01
Scope
We agree what will be tested, how, when, and what is excluded, and record it in the rules of engagement.
- 02
Authorise
You confirm in writing that you own or are authorised to test each asset, and name emergency contacts.
- 03
Test
The specialist partner tests within the agreed windows and stops if anything threatens operations.
- 04
Report
Findings are reported with business impact, reproduction detail where appropriate and remediation guidance.
- 05
Retest
Where agreed, fixed findings are retested and the result recorded.
Who does what
You
- Confirm in writing that you own or are authorised to test each asset
- Obtain permission from hosting or cloud providers where their terms require it
- Name emergency contacts available during testing windows
- Arrange for fixes to be made
Cyber Guys
- Coordinate scoping and the rules of engagement
- Coordinate the specialist partner and keep you informed
- Explain the findings in business terms and coordinate remediation
- Arrange retesting where agreed
Specialist partner
- The specialist partner named in the scope performs the testing within the rules of engagement and produces the findings
Access we need
- Test accounts and environment details as set out in the rules of engagement
- Network access or VPN access for internal testing, where in scope
We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.
Dependencies and licences
- Some cloud and hosting providers have their own testing policies that must be followed
- Testing in production depends on agreed windows and emergency contacts being available
What you receive
- Rules of engagement
- Findings report
- Executive summary
- Retest report, where agreed
How we know it is finished
- Testing of every authorised asset is complete or recorded as not tested with a reason
- The findings report is delivered and walked through with you
- Agreed retesting is complete
Related services
Security baseline and uplift
Find the gaps, fix what matters, prove it is done.
Quoted on scopeRequest a quoteAI security and governance
Use AI tools with clear rules, sensible permissions and evidence.
Quoted on scopeRequest a quoteCompliance readiness
Get ready for independent assessment, with the evidence in order.
Quoted on scopeRequest a quote
Register interest in Penetration testing and assurance
This service is not available yet. Leave your details and we will let you know when it is. Nothing is ordered.