01 · Testing
We test the paths an attacker would attempt: the public portal, staff remote access, the API behind a form, and privileges that should not extend. Findings are ranked by what can be reached, and written so an engineer and an executive can both act.
Severity follows what an attacker can reach, not the novelty of the finding.
External and internal network testing inside the agreed range
Web applications, citizen and customer portals, and APIs
Identity paths, including privileged access and remote entry
Cloud-hosted workloads that are named in the scope
A retest window, priced before the work begins
Technical findings ranked by attacker reach
A short brief for the accountable executive
A remediation order your team or provider can run
A retest record when retest is in scope
Engagement. A defined testing window, followed by a debrief. The retest is quoted with the original work.
Suitable for. Organisations that need a clear account of what a motivated attacker could do to systems customers, citizens, or staff rely on.
Contact
Book a call about the system, your sector, and what you need to achieve.
Book a call