Find weaknesses.
Understand the impact.
Independent security testing for Financial Services, SaaS and Data & Technology — delivered by experienced practitioners and focused on the systems that matter most.
Testing that follows real attack paths.
Manual, evidence-led assessments across your applications, infrastructure, cloud and AI systems.
Web Application Penetration Testing
Manual testing of access control, business logic and real attack paths.
02Infrastructure Penetration Testing
External and internal networks, Active Directory and privilege escalation.
03Cloud Security Testing
Cloud identity, configuration and exposure across AWS, Azure and GCP.
04API Security Testing
Authentication, authorisation, object access and API business logic.
05AI System Security Testing
Agents, RAG, prompt injection, tool permissions and trust boundaries.
06Red Teaming & Adversarial Testing
Objective-led testing of people, process and technology.
Your pen test covered the app. Now test the agent.
AI agents, copilots and LLM features read data, call tools and act on a user's behalf. We test what an attacker can make yours do, and write the report for your customers' security teams.
Prompt injection
Direct and indirect injection through user input, documents, web content and retrieved data.
Tool and permission abuse
What the agent can be made to call, change or approve through its tools, APIs and MCP servers.
Data exposure
System prompts, secrets, other tenants' data and RAG sources leaking through model output.
The application around it
Output handling, authorisation and rate limits on the endpoints that carry the AI feature.
What you get
- Reproducible findings, each with business impact and a recommended fix
- An attestation letter you can share with customers and auditors
- One retest included in the price
- Findings mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS
- Human-led
- Tested by a practitioner, with AI used to speed up the repetitive work
- Fixed price
- From £6,500 plus VAT
- Two weeks
- Typical time from kick-off to report
Agent Security Test £6,500. Multi-agent, RAG or MCP-connected systems £12,500. Quarterly retesting £1,800 a month. Prices exclude VAT.
For software companies that have shipped an AI feature and sell to enterprise or regulated customers. Enterprise security questionnaires increasingly ask how AI features were tested, and a standard web application test does not answer that.
Every test is led by an OSCP-certified practitioner with over 15 years in offensive and defensive security. We test only systems you own and have authorised in writing.
One partner across testing, intelligence and leadership.
Connect what attackers could do with what the threat landscape says is likely — and the senior leadership to act on it.
AI Security Testing
Independent testing of LLM applications, AI agents and connected tools — mapped to the OWASP LLM Top 10 and MITRE ATLAS.
Explore AI testingConsultancy
Fractional security leadership: a vCISO, Fractional Threat Lead or Fractional SOC Director, when you need one.
Explore consultancyThreat Intelligence
Managed CTI, DORA & TIBER-EU targeted intelligence and threat-led tabletop exercises.
Visit the Threat HubFind it. Track it. Fix it. Verify it.
A client portal for published findings, remediation tracking, reports and assessment status. Findings appear as they’re published during the engagement — so your team can act sooner.
Your security posture. At a glance.
Severity and category breakdowns, remediation progress and assessment-level visibility.
Findings you can act on.
Every finding carries a CVSS score, clear evidence and a live status your team can update.
Reports in one place.
Executive and technical reports for every assessment, available whenever you need them.
Close the loop, not just the ticket.
Status updates, notes and attachments — and request a retest when a fix is ready.
Testing is only useful when something changes.
Discuss continuous assuranceAI-assisted speed. Human-led depth.
AI speeds up the repetitive work. Senior testers handle judgement, exploitation and evidence.
Scope
Agree the assets, objectives and rules of engagement.
Test
Efficient tooling combined with senior manual testing.
Report & retest
Clear findings, fix priorities and independent revalidation.
Practical guidance, no jargon.
Need a pentest? Start there.
Tell us what you need to test and we’ll help you scope it — no pressure, no jargon.