Penetration testing for UK organisations
Incursion Cyber Security provides penetration testing for UK organisations: web applications, APIs, mobile apps, external and internal infrastructure, cloud environments, wireless networks, physical premises and system builds. Every test is scoped and delivered by a named consultant holding a UK Cyber Security Council professional title. We are a Cyber Scheme Accredited Company and a fully remote business, with consultants in Somerset, Greater London, West Yorkshire and Renfrewshire working across the UK.
What penetration testing is
A penetration test is a controlled attempt to break into your systems, carried out by a qualified tester with your permission, so that you find the weaknesses before someone else does. It is not a vulnerability scan. A scan lists known software flaws; a penetration test chains together flaws, misconfigurations and design mistakes the way an attacker would, and tells you what they could actually reach. The output is a report you can act on: what we found, how serious it is, what it would let an attacker do, and how to fix it.
What we test
Web applications: customer portals, internal systems, SaaS products, e-commerce.
APIs: REST, GraphQL and SOAP services, tested on their own or alongside the application that uses them.
Mobile applications: iOS and Android, black-box or with source code.
External infrastructure: everything you expose to the internet.
Internal infrastructure: what an attacker or a rogue insider could do once inside your network.
Cloud environments: AWS, Azure and Google Cloud configuration and identity.
Wireless networks: corporate, guest and rogue Wi-Fi.
Physical security: covert and overt attempts to get into your premises.
Build and configuration reviews: Windows, Unix and macOS hardening against a defined standard.
Penetration testing alongside Cyber Essentials Plus: when you need both, scoped together.
How we run a test
Scoping. Your account manager and an active penetration tester work with you to agree the scope of your test on a scoping call. The quote is fixed to it.
Testing. A named, suitably qualified consultant does the work, and you get a direct line to them before, during and after the engagement. Critical and high-risk issues are verified and reported immediately.
Reporting. Easily digestible summaries sum up the whole engagement and support detailed technical findings, written so your team can replicate and fix them. Delivered within 5 working days.
Free retesting. One day of free retesting for every five days of consultancy, taken within 90 days of report delivery, so you can be sure the fixes worked.
Who does the work
The consultant who scopes your test is an active penetration tester with the skill set the work needs, so the scope is accurate and nothing is oversold. Our consultants hold professional titles issued by the UK Cyber Security Council in the Security Testing specialism, and CREST and Cyber Scheme qualifications. Developing testers work as part of a team under a signed-off consultant and never work unsupervised on client engagements. You can see who we are on the team page.
Areas of special interest
We test for organisations in every sector: professional services, financial services, health and care, technology and SaaS, manufacturing, education, charities and the public sector. The method does not change with the industry; the scope does, and that is settled at scoping. There are two areas where we have particular experience or interest and have written about how our services apply: aviation and airlines, where members of the team have hands-on testing experience, and motorsport and automotive, where we are building our work. We will add others as they develop; the full list is on the sectors page.
How long it takes
A typical engagement is 5 to 20 days of testing, though a single application or a small external estate can be shorter and a multi-phase programme longer. Reports are delivered within 5 working days of testing finishing as standard.
What you get
A named consultant with a UK Cyber Security Council professional title, who scoped the work and delivers it.
A report within 5 working days: executive summary, technical summary, and observation, impact and remediation for every finding.
Immediate notification of critical and high-risk issues, once we have verified them.
Free retesting: one day for every five days of consultancy, within 90 days of the report.
A walkthrough call with the consultant for your team, on request, at no extra cost.
Frequently asked questions
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan is automated and lists known software flaws. A penetration test is done by a person who tries to exploit flaws, chain them together and reach something that matters. Scans are useful and cheap; they are not a substitute for a test, and a test that is only a scan with a cover page is not a penetration test.
How much does a penetration test cost?
It depends on scope: the number of applications, hosts, cloud accounts or locations, and how deep you need to go. We quote a fixed price after a scoping call with a tester, and it does not change unless the scope does.
How often should we test?
At least annually, and after any significant change: a new application, a major release, a migration, a merger. Most of our clients test annually with a single retest within 90 days of the report; regulated clients often test more frequently because their regulator or insurer requires it.
Will testing disrupt our systems?
We agree testing windows and exclusions with you on the scoping call. Denial-of-service testing is never done without explicit written agreement. In practice, disruption is rare and we stop and call you if anything unexpected happens.
Are you CREST or CHECK accredited?
Incursion is a Cyber Scheme Accredited Company, and our consultants hold UK Cyber Security Council professional titles as well as CREST and Cyber Scheme qualifications. See our accreditations page for exactly what we hold, with links to the registers.
Ready to scope a test?
Book a call. Our sales team will set it up and handle the proposal; an active penetration tester agrees the scope with you. No obligation.