Project Assess & assure
Penetration testing
If you need to prove your systems hold up, to a customer, an auditor or yourself, a scan isn't enough. We scope the test to what you're trying to prove. You get prioritised fixes, not a 90-page PDF.
- Scope
- Yoursbuilt around what you need to prove
- Report
- [x] daysfrom end of testing to final report
- Retest
- Includedcritical and high findings checked again
- Delivery
- Project or PtaaSa one-off test or testing credits
- Testers
- CREST · CHECKaccredited partners we select
01 / The problem
A scan tells you what might be wrong. A pentest shows what is.
Scans without context
Automated scanners list thousands of issues. They can't tell you which ones chain together into a real attack.
Reports nobody reads
A long PDF of findings lands, then sits. Without clear priorities, the critical fix waits behind the cosmetic ones.
Tests that miss the point
Scope is often set by budget, not risk. The system that matters most ends up out of scope.
02 / What’s included
Tests that match the question you're asking.
External infrastructure
We attack your internet-facing systems the way an outsider would: perimeter devices, exposed services and remote access.
Internal and assumed breach
We start from a compromised laptop or account and see how far we get: Active Directory, privilege escalation, segmentation.
Web application and API
Manual testing of your apps and APIs (application programming interfaces) against the OWASP (Open Worldwide Application Security Project) Top 10 and beyond. Includes the business logic flaws scanners miss.
Cloud and Microsoft 365
Azure, AWS and Microsoft 365 tenants checked for misconfiguration, excessive permissions and exposed storage.
PtaaS
Pentesting as a service: testing credits you draw on when you release, change infrastructure or face a deadline.
[Placeholder: offer for this service, written by ITB]
03 / How it works
From scope to retest.
- Scope We agree targets, objectives, exclusions and testing windows; you sign off a statement of work before we start.
- Test Automated discovery, then manual exploitation to show what's really reachable, with critical findings raised as we find them.
- Report and debrief An executive summary, evidence for each finding and fixes ranked by risk, walked through on a call.
- Retest Once you've fixed the critical and high findings, we test them again to confirm they're closed.
Nobody needs a 90-page PDF. You need to know which three things to fix this week.
How ITB reports pentests
04 / Why ITB
Tested by people who also defend.
We deliver testing with select partners who hold CREST and CHECK accreditation. We scope the test, manage it and turn the findings into fixes. Because we run SOC, EDR and firewall services every day, we know how to fix things in the tools you actually run.
- Attacker and defender view: findings come with fixes that work in your stack.
- Prioritised, not padded: each finding ranked by how exploitable it is and what it would cost you.
- Retest included: proof for auditors and customers that the fix worked.
- PtaaS option: test when things change, not just once a year.
- Help with the fixes: if you want it, the same team can do the remediation.
· 05 / Questions
Penetration testing, plainly answered.
Q01 What's the difference between a vulnerability scan and a pentest?
A scan is automated and lists known weaknesses. A pentest is led by a person who tries to exploit them, chain them together and show what an attacker could reach. For ongoing scanning, see Vulnerability & Critical Patch Management.
Q02 How often should we test?
At least once a year, and after significant change: a new application, a cloud migration, an acquisition. Some standards and customers set their own frequency. PtaaS makes testing on change easier to budget for.
Q03 Will testing disrupt our live systems?
We plan to avoid it. Scoping identifies fragile systems, agrees testing windows and sets emergency contacts. If anything looks at risk, we stop and call you.
Q04 How is a pentest different from red teaming?
A pentest finds as many weaknesses as it can in an agreed scope. Red teaming tests whether your people and tools spot a realistic, stealthy attack. For that, and for continuous attack simulation, see Security Control Validation & Red Teaming.
Q05 How long does a pentest take?
It depends on scope. A small external test might take [x] days; a large internal or application test takes longer. You get a fixed scope and price before we start.
Related services
Vulnerability & Critical Patch Management
Continuous scanning and patching between tests.
See the serviceSecurity Control Validation & Red Teaming
Proves your defences detect and block real attack techniques.
See the serviceSecurity Assessments & Consulting
The wider view of people, process and policy.
See the serviceCompliance: ISO 27001 & CAF
Where pentest results become audit evidence.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]