Penetration testing
Testing for your application, industry and regulations
Choose the page that fits you best. Every engagement starts the same way: ownership verification, agreed scope and written authorisation.
By application type
SaaS applications
Penetration testing for SaaS products: tenant isolation, access control, APIs, authentication and integrations. Start with a complimentary AI pentest.
AI-built websites and apps
Built your website or app with an AI builder or coding assistant? We check for exposed data, weak database rules, leaked keys and broken access control.
Enterprise applications
Penetration testing for internal portals, line-of-business systems and customer platforms: complex roles, SSO, integrations and legacy components.
APIs
API security testing for REST and GraphQL: object-level authorisation, authentication, data exposure and rate limiting, aligned to the OWASP API Top 10.
E-commerce sites
Security testing for online shops: checkout logic, customer accounts, discount abuse, admin panels and payment page scripts.
By industry
Healthcare applications
Penetration testing for healthcare apps, patient portals and health tech handling special category data — supporting NHS DSPT and DTAC evidence.
Law firms and legal apps
Security testing for law firm websites, client portals, document management and legal AI tools. Protect privileged client data.
Fintech and financial services
Penetration testing for fintech apps, payment platforms and financial services firms — supporting PCI DSS, DORA and FCA operational resilience expectations.
By regulation and standard
SOC 2
Does SOC 2 require a penetration test? What auditors look for under the Trust Services Criteria, and how to prepare your application.
ISO 27001
How penetration testing supports ISO 27001:2022 — technical vulnerability management (A.8.8) and security testing (A.8.29) — and what certification auditors look for.
PCI DSS
PCI DSS v4.0 requires penetration testing at least annually and after significant changes. What Requirement 11.4 covers and how to prepare.
Cyber Essentials
Is Cyber Essentials Plus a penetration test? What the UK scheme covers, what it doesn’t, and when you need a separate web application pentest.
DORA
What the EU Digital Operational Resilience Act requires on security testing, threat-led penetration testing (TLPT), and how UK firms serving the EU are affected.
UK GDPR
UK GDPR Article 32 requires regular testing of security measures. How penetration testing helps demonstrate compliance and reduce breach risk.
NHS DSPT
What the NHS Data Security and Protection Toolkit and DTAC ask about penetration testing, and how health tech suppliers can prepare.