Common questions about Incursion Cyber Security
Straight answers to the questions we are asked most often about penetration testing, Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and how Incursion Cyber Security works. If your question is not here, ask us and you will get an answer from a consultant, not a sales desk.
About Incursion Cyber Security
Who is Incursion Cyber Security?
A veteran-founded UK cyber security consultancy and IASME certification body. A fully remote business registered in Somerset, with consultants in Somerset, Greater London, West Yorkshire and Renfrewshire working with organisations across the UK. We provide penetration testing and certify organisations to Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance. We are a Cyber Scheme Accredited Company and a G-Cloud 15 and JOSCAR supplier. Incursion Cyber Security Ltd is company number 14303576, incorporated in 2022.
Who founded Incursion?
Lewis Lockwood, a former British Army Intelligence Analyst, who holds the Chartered Cyber Security Professional (ChCSP) title in Security Testing from the UK Cyber Security Council and remains an active penetration tester. See the team page.
Where are you based and where do you work?
Incursion is a fully remote business, registered in Somerset. Our consultants are based in Somerset, Greater London, West Yorkshire and Renfrewshire and work on site or remotely anywhere in the UK. Remote testing is delivered from the UK; on-site work such as wireless and physical testing is carried out at your premises wherever they are in the UK. International engagements are taken on by arrangement.
What accreditations do you hold?
IASME certification body for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance; The Cyber Scheme Accredited Company; G-Cloud 15 supplier; JOSCAR registered supplier; Armed Forces Covenant signatory with the Employer Recognition Scheme Bronze award. We hold Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance Levels 1 and 2 ourselves. Every one is linked to its register on our accreditations page.
Are you CREST or CHECK accredited?
Incursion is a Cyber Scheme Accredited Company, and our consultants hold UK Cyber Security Council professional titles as well as CREST and Cyber Scheme qualifications as individuals. We publish exactly what we hold, with links to the registers, on the accreditations page, and we update it the day anything changes.
Do you hold ISO 27001?
No. Our information security and quality management are certified under IASME Cyber Assurance Level 2 with the Quality Principles module, which is audited on site by an independent assessor and covers the same ground at a scale appropriate to a specialist consultancy. If a tender requires ISO 27001 specifically, tell us and we will say plainly whether that is a problem.
Penetration testing
What is a penetration test?
A controlled attempt to break into your systems, carried out by a qualified tester with your permission, so you find the weaknesses before someone else does. It goes beyond a vulnerability scan: a person chains together flaws, misconfigurations and design mistakes the way an attacker would and tells you what they could actually reach, how serious it is and how to fix it.
What is the difference between a penetration test and a vulnerability scan?
A scan is automated and lists known software flaws. A penetration test is done by a person who tries to exploit flaws, combine them and reach something that matters. Scans are useful and cheap; they are not a substitute for a test, and a test that is only a scan with a cover page is not a penetration test.
What types of penetration testing do you do?
Web applications, APIs, mobile applications (iOS and Android, black box or source-assisted), external infrastructure, internal infrastructure, cloud environments (AWS, Azure and Google Cloud), wireless networks, physical premises (covert and overt) and build and configuration reviews (Windows, Unix and macOS). Each has its own page under penetration testing.
Who will actually do my test?
A named consultant with a UK Cyber Security Council professional title, who scopes the work and delivers it. The person who scopes your test is an active penetration tester with the skill set the work needs, not a salesperson, so the scope is accurate and nothing is oversold. Developing testers work within a team under a signed-off consultant and never unsupervised on client work.
Will my test be delayed if a bigger client comes along?
No. Incursion runs on three rules: first booked, first served, so a small engagement is never bumped for a larger one that arrives later; no doubling up, so a consultant works on one engagement at a time; and an 85% maximum, so no consultant is asked to spend more than 85% of their working calendar on client projects. Your booked dates are your dates.
How long does a penetration test take?
A typical engagement is 5 to 20 days of testing. A single application or a small external estate can be shorter; a multi-phase programme longer. We confirm the number of days at scoping and the quote is fixed to it.
How quickly will I get the report?
Within 5 working days of testing finishing, as standard. In the last 12 months we delivered a 30-day engagement’s report in three working days.
What is in the report?
An executive summary in plain English, a technical summary, and for every finding the observation, its impact and the remediation. We report everything we find; testing is not cut short to hit a target number of findings or pages.
What if you find something serious during the test?
Critical and high-risk issues are verified first, so we do not waste your time on false positives, and then reported to you immediately. You do not wait for the report to hear about them.
Do you retest after we fix things?
Yes. You get one free day of retesting for every five days of consultancy, to be taken within 90 days of the report, so you can prove the fixes worked. Further retesting is available at the normal rate.
How often should we have a penetration test?
At least annually, and after any significant change: a new application, a major release, a migration, a merger. Most of our clients test annually with a single retest within 90 days. Regulated clients often test more frequently because their regulator or insurer requires it.
Will testing disrupt our systems?
We agree testing windows and exclusions with you on the scoping call. Denial-of-service testing is never done without explicit written agreement. Disruption is rare, and if anything unexpected happens we stop and call you.
Do you test in production or in a staging environment?
Staging if it is a faithful copy; production if it is not. Testing in production is common and safe with agreed windows and exclusions, and it is the only way to be sure the deployed configuration is what you think it is.
How much does a penetration test cost?
It depends on scope: the number of applications, hosts, cloud accounts or locations, and how deep you need to go. We quote a fixed price after a scoping call with a tester, and it does not change unless the scope does. We do not publish penetration testing day rates on the site.
Cyber Essentials and Cyber Essentials Plus
What is Cyber Essentials?
A UK government scheme, owned by the National Cyber Security Centre and delivered by IASME, that certifies an organisation has five baseline technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. The basic level is a verified self-assessment. Certificates are valid for 12 months.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five controls. Cyber Essentials is a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus adds independent technical testing: an assessor runs external and authenticated internal vulnerability scans, malware tests and configuration checks on a sample of your systems. Plus is what larger clients, public sector buyers and insurers increasingly ask for.
Are you a Cyber Essentials certification body?
Yes. Incursion is licensed by IASME to assess and certify Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance. We issue the certificate ourselves rather than preparing you for someone else’s assessment. You can check our listing in the IASME certification body directory from our accreditations page.
How much does Cyber Essentials cost?
Basic Cyber Essentials is priced nationally by IASME and is the same at every certification body: £320 for micro organisations, £440 small, £500 medium and £600 large, plus VAT. Our Cyber Essentials Plus assessment is £1,000 micro, £1,600 small and £3,000 medium, plus VAT, in addition to the basic certificate; large and enterprise organisations are priced on scoping. See Cyber Essentials Plus.
How long does a Cyber Essentials Plus assessment take?
One day for micro and small organisations, one to two days for medium, and three or more days for large and enterprise organisations. Most assessments are carried out remotely by screen share; on site is available where needed.
Do I need Cyber Essentials before Cyber Essentials Plus?
Yes. Plus can only be assessed against a current basic certificate, and the Plus assessment must be completed within 90 days of that certificate’s issue date. We plan both together so the window is not missed.
What happens if we fail Cyber Essentials Plus?
You get a written list of each failed item and why. The scheme requires the retest to be completed within 30 days of the failed assessment, and still inside the 90-day window from your basic certificate. We do that retest free of charge as standard; many certification bodies charge for it. A fail is not recorded publicly.
What most commonly fails Cyber Essentials Plus?
Five things account for most failures: high or critical security updates older than 14 days on a sampled device; multi-factor authentication not enforced on a cloud service; out-of-support software still installed; missing registry keys on Windows machines that leave a control configured but not enforced; and devices, cloud services or users left off the scope declaration.
Does a penetration test count as Cyber Essentials Plus?
No. Cyber Essentials Plus is a specific assessment run by a licensed certification body against the IASME standard, and only that produces a certificate. Equally, passing Plus does not mean you do not need a penetration test: Plus checks five baseline controls on sampled devices and does not test applications, cloud, internal networks or people. See penetration testing alongside Cyber Essentials Plus.
IASME Cyber Assurance
What is IASME Cyber Assurance?
An IASME certification for organisations that have the Cyber Essentials baseline in place and need to demonstrate broader security governance: risk management, policies, data protection, business continuity, physical security and monitoring. Level 1 is a verified self-assessment; Level 2 is audited on site by an independent assessor. See IASME Cyber Assurance.
Do you hold IASME Cyber Assurance yourselves?
Yes, Level 1 and Level 2, both including the Quality Principles module, and we are a licensed certification body for the scheme. Certificates are linked from our accreditations page.
Working with us
How do I get a quote?
For penetration testing, book a call: an active penetration tester confirms what is in and out of scope and you get a fixed quote based on that, which does not change unless the scope does. For Cyber Essentials and Cyber Essentials Plus, tell us your organisation size and answer a short set of standard questions; an assessor reviews them before the proposal is issued, and a call is available if you want one. Contact us.
Can I speak to the consultant who will do the work?
Yes. The consultant who scopes your engagement is the one who delivers it, and you have a direct line to them throughout. After the report, a walkthrough call for your team is available on request at no extra cost.
Do you work with MSPs and IT providers?
Yes. We have a two-tier partner programme for managed service providers who want to offer penetration testing and Cyber Essentials to their clients, white label or in association with us. Your client stays your client, protected by a non-compete in the agreement. See partners.
Can public sector bodies buy from you?
Yes, through G-Cloud 15, the Government Commercial Agency (formerly Crown Commercial Service) framework, which lets public sector organisations buy our services without running a separate procurement. Our G-Cloud 15 listing is on the Digital Marketplace.
Do you work with defence and aerospace suppliers?
Yes. We are a JOSCAR registered supplier, which is the pre-qualification used by UK defence and aerospace primes and their supply chains. Our JOSCAR supplier ID is on the accreditations page.
Can I see a sample report?
Yes. A redacted sample report is published on this site with no email gate: see the sample penetration test report.
Ready to scope a test?
Book a call. Our sales team will set it up and handle the proposal; an active penetration tester agrees the scope with you. No obligation.