Capabilities
IT security & penetration testing
Independent testing and day-to-day security for businesses without a security team.
Overview
Most security incidents at smaller companies start with something ordinary: a reused password, a missed update, a service left open to the internet. Penetration testing finds those weaknesses before someone else does. We then help you close them.
We test from the outside the way an attacker would, review how your systems are set up on the inside, and stay on to run the routine that keeps them secure. You receive the findings in plain language, in order of seriousness.
What we do
- External penetration and vulnerability testing. A seven-phase, non-destructive assessment of your internet-facing systems: ownership checks, host discovery, a full port sweep, service identification, encryption review and vulnerability scanning against the public catalog.
- Written security reports. Scope, method and findings set out so that a customer, an auditor or an insurer can read them.
- Firewall and network security. Firewalls configured, kept up to date and managed from one console, with intrusion alerts reviewed on a schedule.
- Identity and access. Individual accounts, two-factor sign-in, and a clean process for people joining and leaving.
- Endpoint protection. Managed protection on every computer, monitored, with updates enforced.
- Email security. SPF, DKIM and DMARC set up so that your mail is trusted and impostors are rejected.
- Security questionnaires and audits. Help answering customer and insurer questionnaires, and preparing IT controls and evidence for an audit.
- Cloud security reviews. A check of what your cloud environment exposes to the internet and who is able to administer it.
When to call us
- A customer has asked for a penetration test report.
- Your insurer has sent a security questionnaire.
- Staff share administrator passwords.
- Nobody reviews the firewall or sign-in logs.
- You are not sure what your company exposes to the internet.
How we work
01
Agree the scope
We agree in writing what will be tested, when and from where, so nothing is touched that you have not approved.
02
Test and review
We test from the outside, review the configuration on the inside, and confirm each finding before reporting it.
03
Report and fix
You receive a plain-language report in order of seriousness. We help close the findings and test again.
What we work with
- Testing. Industry-standard port and vulnerability scanners, checked against the public CVE catalog
- Endpoints. SentinelOne, with NinjaOne for patching
- Network. UniFi gateways, and Fortinet, Cisco Meraki and SonicWall firewalls, with intrusion detection
- Identity. Multifactor sign-in for Microsoft 365 and Google Workspace, and 1Password
- Websites. Wordfence
- Cloud. Amazon Web Services, Microsoft Azure and Google Cloud
This is a sample of what we work with, not the full list. If your platform is not here, ask. We have very likely worked with it, or with something close to it.
Related work
-
SECURITY TESTING · HEALTHCARE SOFTWARE
Healthcare software: independent security testing, every year
Every year
an external test of the production environment, delivered as a written report
-
SECURITY · MANUFACTURING
Manufacturing: firewalls under one console, reviewed every day
Daily
review of blocked and suspicious activity across every site
-
SECURITY TESTING · MANUFACTURING
Manufacturing: every site’s internet exposure assessed
7 phases
of non-destructive external testing, across every site and every carrier