Infrastructure
Understand what an attacker can reach, what that access permits, and how apparently separate weaknesses can combine.
What we examine
External attack surface
Agreed internet-facing hosts and services, exposed interfaces and configuration weaknesses.
Internal networks
Access boundaries, trust relationships and opportunities for lateral movement within the authorised scope.
Identity & configuration
Authentication controls and system configuration relevant to the agreed environment.
Practical impact
Controlled validation, evidence and prioritised changes for your infrastructure team.
Follow reachable attack paths
External testing examines the agreed internet-facing surface. Internal testing starts from a defined network position and checks how far that access could extend, including trust relationships and identity controls.
Information needed for a quote
IP ranges, host counts, external or internal access, identity services and sensitive systems. Agree testing windows, permitted validation and escalation contacts. Destructive actions, service interruption and persistence require separate explicit agreement.
Evidence included
The entry point, access required, affected systems and controlled validation of impact. The report distinguishes a reachable weakness from a theoretical configuration concern and prioritises changes in their actual network context.
Scope, test, report.
Then verify the fixes.
Scoping, testing, reporting and verification, with direct access to the tester.
Agree the scope.
Applications, roles, access and deadlines. We agree the scope, fee and deliverables before testing.
Run the assessment.
Test the controls and the workflows around them. Significant findings are communicated during the engagement.
Document the findings.
Reproducible findings, demonstrated impact and practical recommendations for your developers.
Verify remediation.
Discuss remediation and validate agreed fixes. Retesting terms are set out in the proposal.