CREST-Accredited Penetration Testing Services
Penetration testing services for applications, networks, and more
Human-led, CREST-accredited penetration testing services, delivered by an in-house consultant.
- CREST member company
- Consultant-led testing
- Transparent pricing
Manual Testing
What a penetration test should be
Exploitr is a CREST Member company, accredited for penetration testing. Every engagement is scoped individually, priced transparently and tested by hand. The consultant who scopes your assessment also carries out the testing, writes the report and runs the debrief, with no account manager in between.
Automated tools are used selectively, for example for fuzzing or directory enumeration, but every finding is validated by the consultant before it reaches your report. Where it is safe and agreed in advance, that means exploiting it to show its impact, and testing whether separate issues chain into a more serious attack path. Scanners aren't built to find chained attack paths or business logic flaws.
What our testing covers
- Web, mobile & desktop applications
- APIs & integrations
- External perimeter & remote access
- Internal networks & Active Directory
- Wireless, hardware & IoT
Methodology
Our penetration testing methodology draws on OWASP WSTG and NIST SP 800-115, with techniques mapped to MITRE ATT&CK and aligned to NCSC guidance.
Application Security
Offensive security testing for your applications and APIs
Manual testing of the software your business runs on, from customer-facing web apps and APIs to mobile and desktop clients.
Web Application Penetration Testing From £2,100
Manual testing of your web application's logic, authentication, and access controls. Not an automated scan.
Learn more
API Penetration Testing From £2,100
Test the REST, GraphQL, and SOAP endpoints behind your applications for broken authorisation, data exposure, and abuse.
Learn more
Mobile Application Security Testing From £3,150
iOS and Android testing covering the application, its storage, and the APIs behind it.
Learn more
Desktop Application Penetration Testing From £3,150
Thick-client testing for privilege escalation, insecure storage, and the services your application communicates with.
Learn more
AI & LLM Application Testing
Testing of chatbots, assistants, retrieval systems and agents, and the application and API around them.
Learn more
Infrastructure Security
Test your network perimeter and internal trust boundaries
How far an attacker could get from the internet, from inside your network, or from the car park.
Network penetration testing overview
External Infrastructure Penetration Testing From £2,100
See what an attacker sees from the internet, before they find the way in.
Learn more
Internal Network Penetration Testing From £3,150
Model a breached laptop or rogue insider, and find the path to domain admin.
Learn more
Wi-Fi Security Assessment From £1,600
Test your wireless networks, guest segregation, and whether an attacker can reach internal systems.
Learn more
Cloud Penetration Testing
Testing of what you run in AWS, Azure and Google Cloud, with a review of your configuration against CIS benchmarks.
Learn more
Configuration & Build Review
Firewalls, Windows and Linux servers and workstations reviewed against CIS benchmarks and vendor guidance.
Learn more
Continuous Assurance
Security assurance between annual tests
Your environment changes every week. These services keep testing and visibility going between point-in-time assessments.
Specialist Offensive Security
Offensive testing for specialist targets
Hardware, people and credentials: the parts of your attack surface that standard testing doesn't reach.
OSINT Reconnaissance
Discover the exposed data, credentials, and assets attackers are already using to target you.
Learn more
Embedded Device & IoT Security Testing From £5,250
Testing of hardware products and IoT devices, from hardware interfaces and firmware to the cloud services behind them.
Learn more
Password Auditing
We crack your password hashes offline to show what your users are really setting, and where passwords are weak or reused.
Learn more
Red Team Engagements
Objective-led adversary simulation across your technology, people and premises.
Learn more
Social Engineering Assessments
Phishing simulations and physical intrusion testing, showing how your staff and premises withstand a realistic attacker.
Learn more
Know what you need tested?
See fixed price ranges for every service, or send us your requirements and we'll reply within one business day to confirm your scope.
Testing Drivers
Which pentest service do you need?
These are the most common reasons clients get in touch, and the service we'd usually recommend for each. For audits and assessments, see our guidance on penetration testing for compliance.
You're preparing for ISO 27001 certification or renewal
ISO 27001 doesn't mandate penetration testing by name, but an independent test is a common way to evidence Annex A control 8.8 (management of technical vulnerabilities). The scope follows your ISMS boundary, mapped to external, internal and web application testing of the assets inside it.You're working towards PCI DSS compliance
PCI DSS Requirement 11.4 requires penetration testing of your cardholder data environment at least annually and after significant change. We test the CDE internally and externally, including segmentation checks, and provide reporting your QSA can work from. See PCI DSS penetration testing.A customer or prospect has asked for a penetration test
Enterprise security questionnaires commonly ask for evidence of recent, independent testing. We scope the test around the product under review and provide an attestation letter and an executive summary you can send to the buyer. See penetration testing for customer security reviews.You're launching or significantly updating a web application or API
Pre-launch is the right time to test. Web application and API testing find authentication flaws, data exposure and business logic vulnerabilities before they reach production.You've never had a penetration test before or aren't sure what you need
That's what scoping calls are for. Tell us about your environment, compliance obligations and concerns, and we'll recommend an assessment that fits your risk profile and budget, with a fixed quote.
Engagement delivery
How we test
Every engagement follows the same phases from our penetration testing methodology, with the depth of each set by the scope agreed at the outset.
Scoping and rules of engagement
We agree the scope, testing hours and restrictions, and confirm a fixed-price proposal before any work begins.
Reconnaissance
We map and enumerate the target environment before active exploitation begins.
Manual testing and exploitation
Your consultant discovers and validates every finding, using tools selectively.
Post-exploitation and privilege escalation
Where the assessment permits, we escalate privileges and move laterally to show real-world impact.
Reporting and debrief
An executive summary and a technical report with evidence and remediation guidance, delivered within two business days of testing, followed by a debrief call with your team.
Exploitr Platform
Between assessments
Every engagement includes access to the Exploitr platform at no extra cost. Findings appear as we confirm them, so your team can start fixing while testing is still under way, request retests from the finding itself, and see how remediation is trending across engagements.
See the platform
Discover
Automatically map your exposed assets.Validate
Consultants confirm which exposures are exploitable.Connect
See how individual vulnerabilities form attack chains.Fix
Prioritise the issues that create genuine risk.
Verify Us
Independent checks and client feedback
Our CREST membership is listed on the CREST Marketplace, and our Trust Centre sets out how we handle client data and the documents available for supplier due diligence.
We don't publish client names. The quotes below are authentic and shared with the client's consent.
I was honestly in the market for box-ticking, but Adam went well beyond the other vendors I'd spoken to. He's given me a lot of very meaningful improvements, and I'm extremely glad I went with Exploitr.
Based on our experience, I have no hesitation in recommending Exploitr, and will be engaging them again.
Buying Advice
What to ask any penetration testing provider
Whoever you choose, these questions show how an engagement will be delivered. Our guide to choosing a penetration testing provider covers them in more depth, and UK penetration testing companies compared compares the types of provider.
Who will carry out the testing?
Is the person you speak to at scoping the person who tests, and what certifications do they hold?
How much of the testing is manual?
Business logic flaws and chained attack paths need a person to find them.
Is any of the work subcontracted?
If it is, ask who carries it out and how they are vetted.
Is retesting included?
Ask which findings it covers and within what timeframe.
Can we see a sample report?
It shows whether findings come with evidence, reproduction steps and remediation guidance.
What happens to findings after delivery?
Ask how findings are tracked, how retests are requested, and how long your data is kept.
It depends on what you're protecting. Testing your own web application or API calls for application security testing. Testing your perimeter or internal network calls for infrastructure testing.
See which penetration test you need above for typical scenarios, or book a scoping call and we'll recommend the right assessment for your environment.
A vulnerability assessment identifies and prioritises weaknesses using scanning tools with expert validation. A penetration test goes further: a consultant manually exploits those weaknesses to show what an attacker could actually achieve.
For a fuller comparison, see vulnerability scanning versus penetration testing.
Yes. Many clients combine web application and API testing, or external and internal network testing, within a single scoped engagement. We also offer a discount for multi-service and long-term engagements. See our FAQs for details.
Our engagements range from £1,600 for a Wi-Fi assessment to £13,100+ for a large internal network, with web application and external network testing from £2,100. See our penetration testing pricing guide for the full breakdown, or request a quote for a fixed-price proposal.
It depends on the service and the scope. Typical timelines are 2 to 6 days for web application testing, 2 to 5 days for external network testing and 3 to 8 days for internal network testing. Reports are delivered within 2 business days of testing completion, and we confirm timelines during scoping.
Testing is designed to simulate real attacks safely, without causing outages. We agree the rules of engagement in advance, avoid destructive techniques unless you explicitly authorise them, and can schedule higher-impact testing outside business hours.
There is an inherent element of risk in any penetration test, so during scoping we ask about legacy, sensitive or business-critical systems that need extra care. Our guides to scoping a web application assessment and scoping a network penetration test cover what to have ready.
Get a tailored quote for your next assessment
Our team are on hand to discuss your security requirements and provide a tailored, fixed-price proposal.