Penetration testing.

What we test

Web applications, REST and GraphQL APIs, mobile apps, cloud configuration across AWS / GCP / Azure, internal networks, identity and access flows, social engineering surface, and supply-chain dependencies. Black box, grey box, or full source-assisted, depending on the engagement shape.

How we report

Each finding documented with reproduction steps, blast-radius analysis, severity scoring (CVSS plus business context), and a remediation path your engineers can execute against. Plus an executive summary that tells leadership what the actual risk to the business is, in language they can act on.

Compliance & certification

Whether you need a pentest for SOC 2, ISO 27001, IRAP, PCI-DSS, or your enterprise customer's procurement check, we produce the certification artefacts your auditor expects. We hand over the readiness pack. Re-test fixes are included in the engagement.

Re-testing & ongoing posture

One-off pentests before a launch, recurring pentests as part of an engagement, or red-team exercises for mature security teams. We can stay on a retainer to test new releases as they ship, so security keeps pace with the product.