What is Incursion Cyber Security?
Incursion Cyber Security is a veteran-founded UK cyber security consultancy and IASME certification body, providing penetration testing, Cyber Essentials, Cyber Essentials Plus and Cyber Assurance certification. A Cyber Scheme Accredited Company and G-Cloud 15 and JOSCAR supplier, a fully remote consultancy registered in Somerset, with consultants in Somerset, Greater London, West Yorkshire and Renfrewshire working UK-wide. The company was founded in 2022 by Lewis Lockwood, a former British Army Intelligence Analyst, and is run by the people who do the work.
Why Incursion exists
I started Incursion Cyber Security in 2022 because I love penetration testing but was becoming disillusioned with the way consultancies run.
Most consultancies judge a client by how much money they bring in rather than by what they actually need. In the year before I set up Incursion I saw three separate five to ten day engagements for small and medium businesses delayed, one of them by three months, because a fifty-plus day job dropped in at the last minute. And consultants get judged the same way: billable days count far more than actual technical skill. Testers routinely work beyond full capacity and double up on jobs because the sales team won’t ask a client to wait a week. The result was tests being delivered by consultants in various stages of burnout, lacking the time to keep up with the industry, and unable to give your job the attention it deserves.
I served in the British Army, where everyone is taught the same six values: Courage, Discipline, Respect for Others, Integrity, Loyalty and Selfless Commitment. I run Incursion using these same values. In practice that means putting others before myself. Nobody needs a brand-new Porsche. They age well, and a second-hand one will make me just as happy.
Lewis Lockwood, Director and Founder
Three simple rules
To combat bumped jobs and consultant burnout, Incursion follows three simple rules:
First booked, first served. A small engagement is never bumped for a larger one that arrives later.
No doubling up. A consultant works on one engagement at a time.
85% maximum. No consultant is asked to spend more than 85% of their working calendar on client projects. The rest is for their own development.
How we work
Scoped by a tester. Every penetration test is scoped by an active penetration tester with the skill set the work needs, not by a salesperson. The quote is fixed to that scope and does not change unless the scope does.
Delivered by the person who scoped it. The consultant who agreed the scope is the consultant who does the work, and you have a direct line to them throughout. We do not advertise qualified testers and send you the new intern.
Supervised development, never unsupervised delivery. We take on developing testers, including people leaving the Armed Forces and the emergency services, and we develop them properly: within a team, under a signed-off consultant, and never alone on client work until senior staff have formally signed them off. They do not scope engagements.
Serious findings reported immediately. Critical and high-risk issues are verified first, so we do not waste your time on false positives, and then reported to you straight away rather than held for the report.
Reports written to be used. An executive summary in plain English, a technical summary, and for every finding the observation, its impact and the remediation. We report everything we find; testing is not cut short to hit a target. Reports are delivered within 5 working days as standard.
Free retesting. One day of retesting for every five days of consultancy, taken within 90 days of the report, so you can prove the fixes worked.
What we hold
We are licensed by IASME as a certification body for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance, and we hold all of those certifications ourselves. We are a Cyber Scheme Accredited Company, a G-Cloud 15 supplier and a JOSCAR registered supplier, we signed the Armed Forces Covenant in 2023 and hold the Employer Recognition Scheme Bronze award, and we are members of the Federation of Small Businesses. Our consultants hold UK Cyber Security Council professional titles in Security Testing, alongside CREST and Cyber Scheme qualifications. Every item is linked to its public register on the accreditations page.
Who we are
A small team, named in full on the team page with their titles. We hire senior-first so the balance of experience stays high as we grow, and we are structured to develop people who come to the industry from the Armed Forces, the emergency services and university. If that is you, see working at Incursion.
Areas of special interest
We work across every sector and do not specialise by industry. Two areas are of particular interest to us and have their own pages: aviation and airlines, where members of the team have hands-on testing experience, and motorsport and automotive, a sector we are actively building work in. Neither changes how we test; both are places where we understand the systems and the pressures well enough to scope accurately from the first conversation.
Where we work
Incursion is a fully remote business, registered in Somerset. Our consultants are based in Somerset, Greater London, West Yorkshire and Renfrewshire and work on site or remotely anywhere in the UK. Remote testing is delivered from the UK; on-site work is carried out at your premises wherever they are. Most of our clients are in the UK; we work internationally by arrangement.
What we do not do
We do not sell managed services, monitoring or software. We test, we assess and we certify, and we tell you plainly what we found. If you need something we do not do, we will say so and, where we can, point you to someone who does.
Ready to talk?
Book a call. Our sales team will set it up, handle the proposal, and put you in touch with the right tester or assessor.