A pentest provides significant value to the business. For the management team, it provides a benchmark of the target assets’ (e.g. an application, an organisation or a network) risk levels and mitigation advice, that helps to prioritise risk remediation.
For technical teams, it is a validation exercise of security controls in place and a learning exercise to avoid similar issues in future.

A penetration test is an exercise to identify technical risks affecting software and hardware in scope. An accurately scoped penetration can add an assurance that the products and security configurations, controls are configured in line with good practices, and no common or publicly known vulnerabilities affect the assets in scope, at the time of the test.

Pen testing can be used as part of a risk assessment or compliance exercise, so it should always be justified with the potential risks and costs associated with the projects.

Main benefits include increased awareness about security issues, reduced operational risks for organisations and input factor into wider IT strategy.

You need to have the permission of the owner of the systems in scope. Therefore, penetration testing companies request permissions via consent forms before commencing security audits. The following acts are references to the most of the penetration testing services:

• UK Computer Misuse Act 1990
• UK Data Protection Act 1998
• UK Data Protection Act 2018 (GDPR)
• Human Rights Act 1998
• Police and Justice Act 2006

Penetration testing sits in various phases during an asset’s business lifecycle. It could be used during Merger & Acquisition transactions, before product purchases, before product launches, before and during product development, after infrastructure or code changes and in general once a year. Pen testing is the groundwork to identify weaknesses in your assets and helping to mitigate the identified risks.

We help customers with IT security compliance requirements. Our assessment methodology covers well-known security standards like OWASP or SANS Critical Security Controls (among others).
For PCI DSS, GDPR, Cyber Essentials or other regulatory specific requirements, you must mention this as the requirement when scoping assessments with Cyphere.

Cyphere’s assessments are designed to be as safe and inconsequential for the customer, while also providing an accurate analysis of their weaknesses. Our assessment methodology ensures that all our assessments are performed with high technical standards, and taking into account any fragile components discussed during project meetings.For PCI DSS, GDPR, Cyber Essentials or other regulatory specific requirements, you must mention this as the requirement when scoping assessments with Cyphere.

Our engagement approach remains focussed on service quality. Three principles underpin our engagement approach: We engage, We listen, and We deliver. The following five steps define our pen test process:

1. Customer Business Insight & Requirements Capture
2. Services Proposal
3. Execution
4. Delivery
5. Debrief & After-care Support

We take customer communication as seriously as the technical elements of the job. We engage with customers throughout a project, ensuring that contacts are up to date in the language they understand and never forgetting about them even after work has been completed. Post engagement, we provide free debriefs for management and technical audiences so it becomes easier to analyse and prepare risk remediation work.

We take customer communication as seriously as the technical elements of the job. We engage with customers throughout a project, ensuring that contacts are up to date in the language they understand and never forgetting about them even after work has been completed. Post engagement, we provide free debriefs for management and technical audiences so it becomes easier to analyse and prepare risk remediation work.

The duration of an assessment varies based on the required focus and the size of the target asset. For instance, an application with dynamic content, integrated authentication and payment modules along with form fields would take longer to assess than a static website with a simple search function. Similarly, network assessments include restrictions, size, accessibility factors while determining the timescales.

Penetration testing pricing is calculated based on the attack scenarios and the time invested in the assessment. A simple web application assessment (considered small) can be conducted within 3-4 days. A large corporate web application with multiple modules may require a few weeks. 
All our pricing provides a breakdown to ensure transparency and flexibility for clients to make an informed choice. 

Penetration testing is an essential part of security for networks, apps and endpoints. It helps to protect against external threats by making sure the system control is safeguarded from unwanted access – whether outside or inside the organisation.

Many a time, penetration testing can be performed remotely. We provide our external IP addresses during every remote assignment so that customer logging and monitoring processes and procedures are aware of this activity. 

Our comprehensive reporting provides both strategic and tactical recommendations. As part of our aftercare service, we help clients prepare risk remediation plans.

• Which assets pose risk by highlighting the vulnerabilities and associated risks?
• What is the impact and likelihood of the attacks associated with identified threats?
• How our remediation advice (both tactical and strategic levels) is helpful?