External network testing
Your internet-facing estate tested the way an attacker finds it: exposed services, weak authentication and missing patches, exploited and confirmed.
Penetration testing as a service: buy credits, test when you need to.
Credits pay for tests, and each kind of test costs a set number of them. Real people test with attacker methodology, and you follow every finding in Canopy, our client portal, from the moment it is confirmed to the retest that closes it.
Buy credits once, spend them on the tests you need.
Testing only happens with written authorization and an agreed scope.
- Buy creditsCredits are how testing is paid for. Buy them up front, then spend them on whichever tests your estate needs.
- ScopeWe agree targets, rules of engagement and testing windows in writing. The scope says which tests you are buying and what they cost in credits, before anything starts.
- TestManual testing with attacker methodology. Scanners find candidates; people decide what is real.
- Follow it in CanopyEach finding appears in Canopy as soon as it is confirmed, with evidence, a CVSS v3.1 score and a fix, not weeks later in one document.
- Fix and retestTell us when a fix is in. We test it again, and the finding closes only when the risk is gone.
sample-findings.txtrisk score 72
- Web applicationcriticalAuthentication bypass
- External attack surfacehigh3 exposed services
- Identity & accessmediumMFA gaps found
- Patch levelresolvedRemediated and retested
What credits buy: every way in, tested by people who build what they break.
Each kind of test has its own credit cost. Spend them on one, or on all of them.
Internal network testing
Assume a foothold, then show how far it goes: lateral movement, privilege escalation and the Active Directory paths to domain admin.
Web application testing
Authentication, authorization, injection and business logic, tested against the OWASP Web Security Testing Guide.
API testing
REST and GraphQL endpoints tested for broken object-level authorization, mass assignment and the rest of the OWASP API Top 10.
Mobile application testing
iOS and Android apps and the backends they talk to, tested against the OWASP MASVS.
Wireless testing
Rogue access points, weak WPA configurations, and guest networks that reach places they should not.
Social engineering
Phishing and pretext campaigns, scoped and authorized, that measure how people respond rather than whether a filter caught it.
Retesting
When a fix is in, we test it again. A finding closes in Canopy only when we have confirmed the risk is gone.
Reports auditors accept
An executive summary, evidence for every finding and a letter of attestation, written for PCI DSS, SOC 2, HIPAA and cyber-insurance reviews.
Spend credits on one test, or on a standing program.
A single test
Credits for one scoped test, its findings in Canopy, and the report at the end.
Good for a launch, an audit or an insurance renewal.
A testing program
A standing scope tested on a schedule, so each round starts where the last one ended and Canopy shows what changed.
Good for estates that change every quarter.
Testing alongside development
New features and releases tested as they ship, by testers who already know the application.
Good for teams shipping software continuously.
A finding is only useful if someone can fix it.
We ship production software too, so our findings come with fixes your developers can apply, and when you want us to, we can apply them.