How does Incursion Cyber Security run a penetration test?
Every Incursion Cyber Security penetration test follows the same four steps: scoping by your account manager and an active penetration tester on a scoping call; manual testing by the named consultant who scoped the work; reporting within 5 working days; and free retesting within 90 days. Critical and high-risk issues are verified and reported to you immediately. This page explains each step so you know exactly what to expect.
Scoping
Scoping is done by an active penetration tester with the skill set your work needs, not by a salesperson. Because the person pricing the work is the person who understands it, the scope is accurate and nothing is oversold: you are not charged for days that are not needed, and the test is not cut short because too few were quoted.
On the scoping call we agree what is in scope, what is out, and what you are most worried about. For a web application that means the number of user roles, the size of the application and whether we test authenticated or unauthenticated. For infrastructure it means the number of hosts and whether we test from the internet, from inside your network, or both. You receive a fixed quote based on the agreed scope, and it does not change unless the scope does.
The tester who scopes your engagement is the tester who delivers it. Scoping calls are guaranteed for penetration testing; for Cyber Essentials and Cyber Essentials Plus scoping is based on organisation size and a short set of standard questions, with a call offered if you want one.
Dates, contacts on both sides, exclusions, testing windows and what happens if we find something serious mid-test are agreed on the same call. There is no separate paperwork to chase.
We ask for two accounts per user role for authenticated application testing, so we can test whether one user can reach another user’s data. For internal infrastructure testing we work on site, over a VPN, or from a small device we ship to you, whichever you prefer. A signed authorisation letter is needed only for covert physical testing, so our consultant can prove they are meant to be there if challenged.
Testing
Testing is manual, led by the named consultant who scoped it. Automated tools are used where they are useful, but the serious findings are almost always in business logic, access control and the chaining of small weaknesses into a real path to something that matters, and only a person finds those. Web and API testing follows the OWASP Web Security Testing Guide and goes beyond the OWASP Top 10; build and configuration reviews are measured against the CIS Benchmarks.
If we find a critical or high-risk issue, we verify it and tell you immediately, not in the report. You can fix it while we carry on testing. We report everything we find; testing is not cut short to hit a target.
Developing testers work as part of a team under a signed-off consultant and never work unsupervised on client engagements. Our consultants hold professional titles issued by the UK Cyber Security Council in the Security Testing specialism, and CREST and Cyber Scheme qualifications. You can see who we are on the team page.
Reporting
Your report is delivered within 5 working days of testing finishing as standard. Recently a 30-day engagement was reported in three working days.
The report has three parts:
Executive summary. Plain English, for the board and the budget holder: what we tested, what we found, how serious it is overall, and what to do first.
Technical summary. The findings at a glance, rated by severity, for the people who will fix them.
Findings. For every issue: the observation (what we found and the evidence), the impact (what it would let an attacker do), and the remediation (how to fix it, specifically).
There is no target length. A report is as long as the findings need it to be. On request, the consultant will walk your team through the report on a call at no extra cost. You can download a redacted sample report to see the format before you buy.
Free retesting
Every engagement includes free retesting: one day for every five days of consultancy, taken within 90 days of the report, so you can prove the fixes worked. Retesting is included. You receive an updated report in which every finding is marked Remediated, Partially Remediated or Still Open, with a new Retest section above the original observation stating how the issue was fixed and what we found. We also test around each fix to check it has not introduced a new issue.
How long a test takes
A typical engagement is 5 to 20 days of testing. A single application or a small external estate can be shorter; a multi-phase programme can be longer. Build and configuration reviews are half a day per build with a one-day minimum. Cyber Essentials Plus assessments take one day for micro and small organisations, one to two days for medium, and three or more for large and enterprise.
What you receive
A named consultant with a UK Cyber Security Council professional title, who scoped the work and delivers it.
A fixed price agreed before testing starts.
Immediate notification of critical and high-risk issues, once verified.
A report within 5 working days: executive summary, technical summary, and observation, impact and remediation for every finding.
Free retesting: one day for every five days of consultancy, within 90 days of the report.
A report walkthrough call with the consultant, on request, at no extra cost.
What we do not do
We do not sell a vulnerability scan as a penetration test. Scans are useful; they are not a substitute for a tester.
We do not run denial-of-service testing without explicit written agreement.
We do not send unsupervised junior testers to client engagements.
We do not stop testing early to hit a target number of findings or days.
Frequently asked questions
Do you test remotely or on site?
Web, API, mobile, cloud and external infrastructure testing is remote. Internal infrastructure testing is on site, over a VPN, or from a small device we ship to you, whichever suits you. Wireless and physical testing is on site.
Who will actually do the testing?
The named consultant who scoped your engagement. Developing testers may work alongside them under supervision, but never alone.
Will testing disrupt our systems?
We agree testing windows and exclusions with you on the scoping call. In practice disruption is rare, and we stop and call you if anything unexpected happens.
What if you find something serious during the test?
We verify it and tell you immediately by phone or email, so you can start fixing it while testing continues. It is also in the report.
Can we see a report before we buy?
Yes. A redacted sample report is available on the sample report page with no form to fill in.
Ready to scope a test?
Book a call. Our sales team will set it up and handle the proposal; an active penetration tester agrees the scope with you. No obligation.