WhatsExposed
EU/UKUS

Somebody’s going to find your way in. Make it us.

A full job to start. Then the crew’s back every time something changes.

See what’s exposedMeet the crew

CREST accredited and ISO 27001 certified. The first look is on us, and it touches nothing.

Annual job

One visit, one PDF, eleven quiet months.

The crew on retainer

The same testers, back every time something changes, findings live the day they’re confirmed.

Banks, insurers, retailers and regulators already let us in.

  • Allianz
  • Liongard
  • The Royal Parks
  • Uniphar
  • Bank of Ireland
  • Musgrave
  • Dublin City University
  • Carne
  • daa
  • humm
  • Taoglas
  • SIRO
  • Waterford
  • Mercury Engineering
  • Galway
  • Flynn O'Driscoll
  • CU Plus
  • GAA
  • H&MV Engineering
  • Met Éireann
  • The Pensions Authority

Your last pen test was a photograph. Attackers watch the video.

  • 364days a yearly test leaves untouched
  • 7daysat most, before the crew is back on anything that changed
  • 24hoursto retest a critical once you say it’s fixed

New server, new release, new starter, new leaver, new exploit on the news. Each one is a door that didn’t exist when the photo was taken.

Three ways to hire the crew.

On the job

Keep the crew on retainer

A full job in the first month. After that we’re back whenever something changes, we run the new attacks the week they land, and every fix gets retested. No one waits for next year.

See what’s exposed
  1. JanFull job
  2. MarNew web release, tested
  3. MayVPN flaw published, tried against you
  4. JulNew cloud account, tested
  5. SepPhishing run
  6. OctRetest
  7. DecAttestation letter for your auditor

The lookout

Unified Exposure Management

Everything you’ve left on the internet, watched all year, confirmed by a tester before it reaches you.

One-off jobs

When you just need the one test

External, internal, web apps, cloud, Microsoft 365, red team, phishing.

What the crew did last year for one client.

Six changes nobody would have looked at until the next annual job. Two of them were ways in.

A yearly test

Annual testEleven quiet months

The crew on retainer

  1. FebNew web releaseTested
  2. AprNew cloud accountTested
  3. MayVPN flaw publishedCaught
  4. JunVPN fixRetested
  5. JulNew supplier integrationTested
  6. SepSupplier admin left openCaught
  7. OctAccount closedRetested
  8. NovNew releaseTested
  • 6changes tested
  • 2ways in caught
  • 2fixes retested

See what a year on retainer costs you.

See what’s exposedTalk to a tester

From the case files.

Two recent jobs, with the clients’ names kept out of it.

US port operator, critical infrastructure

2/10attack paths walked straight past their endpoint protection. Nobody saw them.

We bypassed the EDR their whole defense leaned on. Twice.

Seven attack phases over thirty days against 759 live accounts, some phases unannounced, every step matched against their logs. Two critical blind spots in an enterprise EDR, found, proven and closed before anyone else could use them.

Found, closed and retested inside the same thirty days. Not written up for next year’s visit.

Purple teamEDR evasionZero disruption to operations

Identity verification provider, regulated fintech

4live customer logins sitting in criminal stealer logs.

A critical their last pen test could never have found.

Working credentials for their customer portal, harvested from infected machines at four separate organizations, one of them tied to a retired admin host that was still answering. Rated critical and raised without a single packet sent at their systems.

Caught in week one because the crew was already watching, not because a test happened to be scheduled.

Exposure managementDark web and stealer logs

See a sample report

WhatsExposed demonstrated a profound understanding of cyber security principles and methodologies. Their expertise in identifying vulnerabilities and potential exploits was instrumental in enhancing security posture for our customers.
RicohIan O’CallaghanSecurity Division Lead, PFH, a Ricoh company
The new portal is a game changer. Clear, concise, simple to navigate, transforming security testing from static reports into real-time, actionable insights. It makes results dynamic, practical, and directly useful in our daily cyber security operations.
MusgraveEamon FoxCyber Security Lead, Musgrave

Every finding has a name on it.

Mark Drinan and two Team Leads run the crew and sign every report. Nobody marks their own homework.

Mark Drinan
The mastermind

Mark Drinan

Head of Offensive Security

Gold for Ireland at the WorldSkills Global Skills Challenge in Melbourne. Every engagement signs off through him.

Daniel Scragg
The safecracker

Daniel Scragg

Team Lead, Offensive Security

OSCP, OSEP, OSWE, CRTO and CREST. Teaches red teaming to thousands on YouTube.

Fehmi Berisha
The wild card

Fehmi Berisha

Team Lead, Offensive Security

Thinks sideways, moves fast and finds the way in nobody planned for. Leads red team and physical engagements.

The records speak for themselves.

  • OSCPOSCP
  • CREST CRTCREST CRT
  • CRTOCRTO
  • OSCE³OSCE³
  • OSEPOSEP
  • CREST CSPACREST CSPA
  • CRTPCRTP
  • CRTLCRTL
  • eWPTXeWPTX
  • PNPTPNPT
  • Burp Suite Certified PractitionerBurp Suite Certified Practitioner
  • eJPTeJPT

Run an MSP? Put your name on the van.

Sell our testing under your own brand. Your client stays yours.

See the partner program
  • PFH
  • Grant Thornton
  • Expleo
  • SecureSpace
  • Viatel
  • Innovate
  • Origina
  • Pure Networks
  • Zenotec

Questions people ask before the job.

What does the first look involve?

Give us your domain and a tester checks what your business exposes to the internet, using only what is already public. Nothing is sent at your systems, and a tester is in touch within 24 hours.

Will my auditor accept the report?

Yes. Every report is signed by a qualified tester independent of your IT team, which is what PCI DSS, SOC 2, HIPAA and insurers look for.

Do you use AI?

Only if you opt in. A certified tester confirms every finding and signs the report either way.

Find out what’s changed since your last job.

Tell us your domain and we’ll come back with what we found and a plan.

See what’s exposedTalk to a tester

See a sample report.

Tell us who you are and the report opens straight away.

We use your details only to follow up on the report. See our privacy notice.