Penetration Testing Services
Every attack surface, tested from an attacker's perspective.
Pentest Requirements
Which type of penetration test do you need?
Not every organisation has the same requirements. Here are the most common situations we see, and the testing we’d typically recommend.
Not sure what's right for you?
Book a free scoping call and we’ll help you identify the right type of assessment for your environment, compliance requirements, and budget.
Speak to an expertYou're preparing for ISO 27001 certification or renewal
Your ISMS audit will expect evidence of independent security testing. We’d typically recommend an external network penetration test as a starting point, combined with web application testing if you have customer-facing systems in scope.
You're working towards PCI DSS compliance
Requirement 11.4 mandates penetration testing of your cardholder data environment at least annually and after significant change. We scope CDE-focused engagements to meet PCI DSS requirements and provide evidence-ready reporting for your QSA.
You're launching or significantly updating a web application or API
Pre-launch is the right time to test. Application penetration testing identifies authentication flaws, data exposure risks, and business logic vulnerabilities before they reach production - using the same techniques a real attacker would apply.
You're building or shipping a mobile or desktop application
Client-side products introduce a different category of risk: reverse engineering, insecure local storage, weak cryptography, and backend API vulnerabilities that standard web testing alone won’t surface.
Your development team ships frequently and point-in-time testing isn't keeping up
When teams deploy weekly or continuously, annual testing creates blind spots. PTaaS provides ongoing offensive coverage, on-demand consultant access, and unlimited retesting without repeated re-scoping.
You've never had a penetration test before or aren't sure what you need
That’s what scoping calls are for. Tell us about your environment, compliance obligations, and specific concerns. We’ll recommend an assessment that fits your risk profile and budget, and provide a fixed quote within 24 hours.
Application Security Testing
Offensive security testing for your applications and APIs
Web Application Testing
Manual offensive testing that goes well beyond automated scanning. We approach your application the way a real attacker would - chaining weaknesses across authentication, authorisation, and business logic to identify what’s genuinely exploitable.
Covers the OWASP Top 10 and beyond, across all user privilege levels.
Recommended for:
- SaaS companies
- E-commerce platforms
- Customer portals
- Startups with newly deployed MVPs
Website Security Testing
A focused, practical security assessment for public-facing business websites, corporate sites, and CMS-driven platforms. Covers the external attack surface: CMS and plugin exposure, TLS configuration, security headers, admin panel exposure, and common misconfigurations.
The right starting point for organisations that need assurance their website is not presenting unnecessary risk.
Recommended for:
- Corporate and brochureware websites
- CMS-based and WordPress sites
- Marketing and agency-managed sites
- Organisations new to security testing
API Security Testing
Secure your REST, GraphQL, and SOAP APIs against data exposure and unauthorised access.
OWASP API aligned testing covering broken authorisation, excessive data exposure, rate limiting issues, and parameter tampering vulnerabilities in your microservices, public APIs, and mobile backends.
Recommended for:
- Public API services
- Microservices architectures
- Mobile app backends
- Third-party API integrations
Mobile Application Security
Recommended for:
- Consumer mobile apps
- Fintech and banking apps
- Healthcare mobile applications
- Apps handling sensitive user data
Desktop Application Testing
Recommended for:
- Enterprise desktop software
- Client-installed tools handling sensitive data
- Electron and cross-platform applications
- Internal tooling and admin portals
Network & Infrastructure Testing
Test your network perimeter and internal trust boundaries
External Network Penetration Testing
Recommended for:
- Organisations with internet-facing services
- Pre-audit compliance testing
- Businesses undergoing ISO 27001 or PCI DSS
- Teams preparing for a red team engagement
Internal Network Penetration Testing
Recommended for:
- Organisations with on-premise infrastructure
- Businesses with hybrid AD environments
- Post-breach validation and hardening
- Compliance-driven internal security reviews
Wi-Fi Security Assessment
Recommended for:
- Office-based organisations with wireless infrastructure
- Businesses with guest Wi-Fi networks
- Retail and hospitality environments
- Organisations with BYOD policies
Vulnerability Assessment
Recommended for:
- Organisations new to security testing
- Teams needing rapid vulnerability insight
- Compliance-driven periodic assessments
- Pre-pentest hygiene reviews
Specialist & Continuous Offensive Security
Go further with testing that keeps pace with your environment
Pentest as a Service (PTaaS)
Recommended for:
- Teams shipping weekly or continuously
- SaaS companies with fast release cycles
- DevSecOps-driven organisations
OSINT Reconnaissance
Recommended for:
- Pre-assessment reconnaissance
- Organisations assessing their exposure
- Executive and personnel threat profiling
Embedded Device & IoT Testing
Recommended for:
- IoT product manufacturers
- Connected device companies
- Smart home and industrial hardware
Not sure which assessment you need?
Book a free scoping call and we’ll help you identify the right type of offensive security assessment for your environment, compliance requirements, and budget.
Key Deliverables
What's included in every engagement?
Our offensive security engagements are designed to support both technical remediation and executive-level decision-making. Every Exploitr assessment includes the following as standard.
Executive Report
A non-technical summary of findings with risk ratings and recommendations suitable for board and senior management stakeholders.
Technical Report
A detailed report for your technical team covering each vulnerability, reproduction steps, severity scoring, remediation guidance, and mappings to CVE, CVSS, and MITRE ATT&CK where applicable.
Debrief Session
A debrief call to walk through findings, discuss remediation priorities, and answer questions from both technical and executive stakeholders.
Retesting
Free focused retesting of any remediated vulnerabilities for externally-based assessments - including web application, API, and external network penetration testing.
Attack Surface Center Access
Complimentary access to our Attack Surface Center ASM platform to review, track, and collaboratively remediate findings in real time throughout and beyond the engagement.
Consultant-led From Start to Finish
All testing is performed by in-house consultants. Your assigned consultant works with you from scoping through to debrief. Nothing is outsourced or subcontracted.
Our Approach
Offensive security led by consultants, not scanners
Every engagement is scoped individually, priced transparently, and delivered directly by the consultant assigned to you from the very beginning. Our offensive security methodology draws from OWASP WSTG and NIST SP 800-115, with adversary-informed techniques aligned to the MITRE ATT&CK framework and NCSC guidance.
Whether your goal is meeting a compliance requirement, validating a pre-launch application, or understanding your real-world attack exposure, we focus on finding vulnerabilities that matter to your business, not padding a report.
How It Works
Our Penetration Testing Process
Our process is designed to replicate realistic attacker behaviour while remaining safe, transparent, and aligned with your business context from initial scoping through to final reporting.
Common Questions
Penetration testing & offensive security - frequently asked questions
Everything you need to know about how our offensive security assessments are scoped, priced, and delivered before you request a quote.
All testing is carried out by our in-house consultants, and nothing is outsourced or subcontracted. You’ll be assigned a named consultant before testing begins, and they’ll remain your point of contact from scoping through to debrief.
Our consultants hold industry-recognised OffSec certifications including OSCP (Offensive Security Certified Professional) and OSCE (Offensive Security Certified Expert).
Pricing is based on scope, complexity, and your organisation’s context. We publish realistic price ranges so you can quickly assess fit before requesting a quote.
For bespoke engagements, we tailor methodology and consultant time to your objectives. Each quote factors in:
- Scope of testing (e.g., number of IPs, applications, or cloud resources)
- Technical and architectural complexity
- Testing methodology (black box, grey box, white box, or blended)
- Depth of exploitation, reporting, and retest support required
To ensure accurate pricing by not over or under-scoping an assessment, we aim to learn as much about your business and the target(s) as possible.
A scoping call reduces back-and-forth over email, allows for quick walkthroughs of applications or infrastructure, and gives us the context we need to tailor an offensive assessment to your specific risk concerns.
We’re able to support scoping discussions via email if preferred.
Most engagements range from 3-5 days depending on the type of assessment and the complexity of your environment. To get accurate timelines, speak with us to scope out a project with no obligation.
Retesting is available and can be bundled or quoted separately. For certain assessments, including external network, web application, and API penetration testing, we include free spot-check retesting of remediated findings at no additional charge.
Yes, we can provide a discount for multi-service engagements and repeat, long-term engagements. If you are a charity, start-up, or public services organisation, let us know and we can discuss how we can work together within your budget.
Our methodology is based on your objectives, environment, and threat model, not a one-size-fits-all approach.
As an example, a public B2C SaaS platform may be assessed black-box to emulate an untrusted external attacker, while authenticated workflows are tested grey-box to validate deeper privilege abuse paths.
We also support blended engagements that apply different offensive approaches across reconnaissance, exploitation, and post-exploitation to give a more realistic perspective.
Yes, Exploitr is VAT registered under GB VAT 476701277. Prices displayed or provided within a quote exclude VAT unless otherwise noted.
Yes, Exploitr is fully insured for public and products liability, professional indemnity, cyber, and more.
Ready to test your defences from an attacker's perspective?
Our team are on hand to discuss your security requirements and provide a tailored, fixed-price proposal within 24 hours.