Cyber Security Services & Testing

From a first independent assessment to a fully managed security function, we cover every layer of your cyber defence.

• Vulnerability Assessments: Systematic automated and manual identification of weaknesses across servers, networks, cloud environments and applications, validated by consultants and scored with CVSSv3.
• Penetration Testing: CREST and CHECK-qualified simulated attacks across networks, web applications, APIs, mobile apps and people, with evidenced findings and a free retest to confirm the fixes hold.
• Security Architecture Review: Analysis of your architecture against zero trust principles, CIS v8 benchmarks and the current threat landscape, delivered as a sequenced improvement roadmap.
• Incident Response Planning: Response procedures, scenario playbooks, tabletop exercises and team training, aligned with NIST SP 800-61 and NCSC guidance, including ICO 72-hour reporting.
• Network Security Assessment: In-depth review of network infrastructure, firewall rule sets, segmentation strategy, VPN and remote access, and perimeter controls.
• Application Security Testing: Testing of web applications, REST and GraphQL APIs and mobile apps against the OWASP Top 10 and OWASP ASVS, with remediation guidance for developers.
• Cloud & Microsoft 365 Hardening: Configuration review of Azure, AWS, Google Cloud and Microsoft 365 against CIS benchmarks, covering identity, conditional access, data exposure and backup resilience.
• Wireless Security Audit: Assessment of wireless security including rogue access point detection, encryption standards, guest isolation and remote access exposure.
• Security Awareness Training: Employee training and phishing simulation covering social engineering, secure data handling, password hygiene and breach reporting, with measurable improvement over time.
• Cyber Essentials & ISO 27001 Readiness: Gap analysis, control implementation and evidence preparation for Cyber Essentials, Cyber Essentials Plus and ISO 27001 certification.
• Fully Managed Security Service Provider: Your entire cyber security function, outsourced. 24/7 monitoring and alerting, endpoint detection and response, patching, email and firewall management, backup, identity controls and incident response, with one team accountable for all of it.

How you work with us matters as much as what we deliver. Every engagement starts with a short discovery call and a scoped assessment rather than a large programme, and scope, effort and cost are agreed in writing before anything starts.

We also provide awareness training staff actually complete, phishing simulation reported in plain language for management, and supplier due diligence when a new vendor needs assessing before go-live. Everything is documented in a form you can hand to an auditor, an insurer or a client's procurement team, and nothing depends on us staying engaged: the aim is a position your own team can maintain with the tools and knowledge already in place.

If your question is not covered here, a consultant will answer it directly, with no sales script.

Should we do Cyber Essentials or go straight to ISO 27001? If clients are asking for a basic security baseline or you are bidding for public sector work, Cyber Essentials is the faster route. If contracts require a management system or you handle sensitive data at scale, ISO 27001 is the better destination, and Cyber Essentials becomes a milestone on the way. We can scope both, and tell you plainly which one your clients will actually accept.

How often should we run penetration tests? Most organisations test annually, but anything that changes your attack surface should prompt a review: a new application, a cloud migration, a major infrastructure change or a new regulatory obligation. We recommend a cadence based on your risk profile, the data you hold, and your clients' expectations, and we will say if an annual test is more than you need.

What happens if we have already been breached? Contain first, then investigate. We help you stabilise the environment, preserve evidence, establish how the attacker gained access, and close that route in before restoring services. We then manage the notification decisions that follow, including the ICO 72-hour reporting window, and build the incident response plan and controls that prevent a repeat.

Can you work with our existing IT provider? Yes. We regularly work alongside in-house teams and managed service providers, providing independent assurance and clear, prioritised guidance rather than duplicating what your team already does. Findings are written so your provider can action them directly.

What does an assessment involve commercially? Scope, effort and cost are agreed in writing before anything starts, with no surprise line items. A focused vulnerability assessment or single-application penetration test typically runs over a few days, an architecture review over four to six weeks, and incident response planning over two to three phases. Fixed-price options are available for well-defined scopes.

Can you handle security on an ongoing basis, not just one-off tests? Yes. As a managed security provider we can take on 24/7 monitoring and alerting, endpoint detection and response, patching, email and firewall management, backup validation, identity controls and incident response, with one team accountable for all of it and monthly reporting against agreed service levels.

Do we need data protection support too? Often, yes. If you handle personal data at scale, the practical answer usually combines technical security with UK GDPR obligations: records of processing, privacy notices, subject access handling and, in some cases, an outsourced Data Protection Officer. We provide that support alongside the technical work so the two are consistent rather than contradictory.