Pick the job.
Any of these on its own. Or keep the crew on retainer and they run again every time your systems change.
Penetration tests: every way in.
From the edge, through your people, from the inside, or all of it at once.
The edge
- External networkEverything you expose to the internet
- Web apps and APIsLogins, payments and the logic scanners miss
- CloudAzure, AWS and Google Cloud
- Mobile appsiOS, Android and their back ends
The inside
- Internal and assumed breachStarting from one phishing click
- Identity and Active DirectoryEvery route to domain admin
- WirelessWi-Fi that reaches too far
- OT and IoTTested safely around live equipment
All of it
- Red teamA goal-based attack on the lot
- Purple teamWe attack while your defenders watch
- Unified Exposure ManagementWatching everything you expose
On retainer, every one of these runs again when the thing it covers changes. New app, new office, new cloud account: the crew is back inside a week, not next year.
Configuration reviews: is it set up the way you think?
Each review checks how something is built, line by line, against the vendor’s and CIS benchmarks. The fixes come in priority order.
Microsoft 365 and Entra ID
Exchange, Teams, SharePoint, OneDrive, Entra ID, Defender and Intune checked against the CIS benchmark, then checked again whenever the tenant drifts.
Azure, AWS and Google Cloud
Subscriptions, identity, networking, storage, key vaults and logging against each provider’s CIS foundations benchmark.
Firewalls and network devices
Rule bases, management access, logging and segmentation on the equipment that’s meant to keep people out.
Endpoint and device builds
Laptop and server builds against the hardening standard you say you follow, before a crew checks for you.
Copilot and AI assistants
What they can reach, what they’d leak, what to lock first. More on AI
Add a review to your retainer and it runs again after every tenant or platform change. Microsoft 365 moves monthly; so do we.
Assessments: rehearse the bad day.
How a ransomware crew would move through you, and how your leadership team copes when it happens. Better found on a Tuesday rehearsal than at two in the morning on a Saturday.
Ransomware readiness
How a ransomware crew would get in, spread and encrypt in your environment, and the handful of controls that would have stopped them.
Crisis simulation and tabletop
Your leadership team through a realistic incident, so the first time isn’t the real one.
Cyber insurance readiness
The controls your carrier asks about, tested before you fill in the application.
On retainer these get placed through the year: ransomware readiness in Q1, tabletop in Q2, the cyber insurance questions answered before renewal.
How a job runs.
Scope
A short call. You tell us what matters and we confirm in writing exactly what we’ll touch.
Test
Findings land in your portal the moment a tester confirms them. Nobody waits for the write-up.
Criticals
A phone call the same day. Then it’s written up within the hour.
Report
Signed by a Team Lead when the job closes. Executive summary for the board, detail for the engineers, one document.
Retest
Criticals within 24 hours of your fix, everything else within three working days. Free, as often as it takes.
Testing your auditor accepts first time.
Every report is signed by a certified tester independent of your IT team, written to what PCI DSS, SOC 2, HIPAA, ISO 27001 and the FTC Safeguards Rule ask for.
One retainer for the whole year of jobs.
Full job in month one. After that the crew comes back for every change, runs the new attacks the week they’re public, retests every fix and runs a phishing campaign, all inside the retainer.