Penetration Testing & Security Audit
A controlled attack on your own systems that finds the holes before a criminal does — with a clear report and a fix list.
When “we think we’re secure” isn’t good enough
You’ve put protections in place — a firewall, antivirus, backups, maybe multi-factor authentication. But nobody has ever actually tried to break in and tell you what they found. That gap is where trouble lives. A misconfigured server, a forgotten admin account, a password reused from a breach, a public login page with no lockout — each looks fine on its own, and together they hand someone the keys.
A penetration test closes that gap by testing your defences the way a criminal would, safely and with your permission. A security audit steps back and checks whether your setup matches recognised good practice. Together they replace guesswork with evidence: what’s actually exposed, how bad it is, and what to do first.
What’s included
- External penetration testing — we probe everything facing the internet: your website, email, remote-access and VPN logins, firewall and any exposed services, from an attacker’s point of view
- Internal penetration testing — we test what someone could reach once inside, whether a rogue laptop, a phished employee or a visitor on your Wi-Fi, and how far they could move across the network
- Vulnerability scanning — automated sweeps across your devices and servers to find missing patches, weak configurations and known flaws
- Authenticated review — where useful, we log in as a normal user to test what a real account (or a stolen one) could do
- A plain-English report — every finding rated by risk, with proof of what we reached, the business impact, and a clear step to fix it
- A remediation call — we walk you and your IT provider through the fixes in priority order, no jargon
- A free re-test of the high-risk findings once you’ve fixed them, so you can prove they’re closed
Who it’s for
South London, Croydon and Surrey businesses that hold customer data, take payments, or are being asked to prove their security to someone else. That includes professional services and finance firms under FCA or client scrutiny, healthcare and charity organisations handling sensitive records, e-commerce and SaaS companies with a public-facing app, and any business chasing ISO 27001, SOC 2 or Cyber Essentials Plus. Home-workers and hybrid teams matter here too — a home broadband router or an unpatched personal laptop is often the softest way into an otherwise tidy network, and we factor remote setups into internal testing.
How it works
- Scoping — we agree what’s in scope, what’s off-limits, timing and rules of engagement, all in writing, so testing is safe and legal
- Reconnaissance — we map what’s actually exposed, often finding forgotten services and old systems you didn’t know were public
- Testing — we run the scans, then test the promising findings by hand to confirm what can genuinely be exploited (no false alarms)
- Reporting — you get a report with an executive summary for the board and technical detail for whoever fixes it, each issue ranked by risk
- Remediation & re-test — we talk you through the fixes, then re-test the serious ones so you have evidence they’re resolved
Problems we commonly fix
- Compliance and client demands — you need an independent test for an insurer, an ISO 27001 audit or a tender, and want it done right the first time
- Unknown exposure — old servers, test sites and remote-access ports quietly facing the internet
- Weak authentication — logins with no multi-factor, no lockout, or passwords already leaked in known breaches
- Missing patches — devices and software with known flaws that never got updated
- Flat networks — once someone’s in, nothing stops them reaching everything, so a single laptop becomes a full compromise
- Findings with no plan — you already had a test but were handed a 60-page PDF and no idea what to fix first
Penetration testing is a point-in-time check — powerful, but a snapshot. It works best alongside ongoing cyber security and monitored backup and continuity, so the gaps we find stay closed. If a test turns up an active compromise, our virus and malware removal team can step in, and we can fold the fixes into your managed IT support. Not sure which assessment you need? Get in touch and we’ll point you at the right one.
Frequently asked questions
What's the difference between a vulnerability scan and a penetration test?
A vulnerability scan is an automated check that lists known weaknesses — useful, but it doesn't prove any of them can actually be exploited. A penetration test is a person safely attempting to break in, chaining those weaknesses together the way a real attacker would, then telling you what they reached and how. We often run a scan first to map the ground, then test by hand where it matters.
Will the testing take our systems down?
No. We agree the scope, timing and rules of engagement with you in writing first, avoid anything destructive, and can run intrusive checks out of hours. The goal is to find problems safely, not to cause an outage.
A client (or our insurer) is asking for a pen test — is that what we need?
Usually yes. Contracts, cyber insurance renewals and frameworks like ISO 27001 or SOC 2 increasingly ask for an independent test at least annually or after a major change. We'll confirm exactly what they expect so you buy the right assessment rather than over- or under-scoping it.
Related services
Trusted by London businesses.
“Honest and transparent — they could have charged me more, but instead showed me a simple fix. Trustworthy people.”
“One of the most ethical companies I’ve ever dealt with. A genuine pleasure to work with — highly recommended.”
“The service was flawless — no bad surprises, everything just worked. Highly recommended.”
“Thank you very much for your assistance. A pleasure as always.”
Feedback from clients of our team, including our sister company PC Macgicians, who deliver much of our engineering work. Names withheld at their request.
Areas we cover
Penetration Testing & Security Audit across South London, Croydon and Surrey — on-site where you need it, remote everywhere.
Need help with Penetration Testing & Security Audit?
Tell us what you need and we'll come back with a clear, no-obligation plan and price.