PK-01Announced
Essentials
- External network test
- External attack surface assessment
- Phishing campaign
Best forFirst security baseline; small and mid-sized organizations
Test it like an adversary. Fix it like a defender.
Penetration testing, red teaming, social engineering and purple teaming from one offense-informed team. Choose from 34 coded services, five packages and six add-ons, and get a fixed quote after a 30-minute scoping call.
One team that finds it, proves it and helps fix it
Our cybersecurity practice is offense-informed. The operators who run your penetration test or red team also build detections and harden identity and cloud environments, so findings turn into working controls.
Find
We start where an attacker would: external reconnaissance, a phishing pretext, an internal foothold or a compromised account.
Prove
Every finding comes with evidence and reproduction steps, ranked by severity, inside an attack narrative that shows how weaknesses chain together.
Fix
Purple team replays, remediation support and a retest of critical and high findings close the loop.
Six service lines, one menu
Every service has a code. Pick the ones that match your goal, or start from a package.
Penetration testing
Find and prove every exploitable weakness in scope.
PT-01 to PT-10AnnouncedRed team engagements
Chase one objective the way a real adversary would.
RT-01 to RT-05CovertSocial engineering and physical testing
Test the people, processes and buildings around your systems.
SE-01 to SE-04Standalone or add-onPurple team and detection readiness
Fix detection gaps during the engagement, not after it.
PU-01 to PU-04CollaborativeSpecialized services
AI and LLMs, OT and IoT, leadership exercises and acquisitions.
SP-01 to SP-04ScopedGRC and continuous inspection
Keep assessing networks after they go live.
GR-01 to GR-07ContinuousWhich kind of test do you need?
The biggest difference is who knows the test is happening, and what it measures.
Your team knows
Penetration test
Announced and built for breadth. Finds and proves as many exploitable weaknesses as possible in a defined scope. Suits compliance and pre-launch assurance.
PT-01 to PT-10Side by side
Purple team
Our testers run techniques one at a time while your SOC tunes alerts and retests live, so gaps get fixed during the engagement.
PU-01 to PU-04Your SOC does not know
Red team
Acts like a real adversary chasing a business objective. Measures detection and response, not just vulnerabilities. Suits organizations that already test regularly.
RT-01 to RT-05Where to start
Match your goal to a starting point. The scoping call confirms it, and we will say so if a smaller engagement answers your question.
If you need to
meet a compliance requirement (PCI DSS, SOC 2, HIPAA, ISO 27001)
External and internal network test, application test
PT-01PT-02PT-03
If you need to
secure a new app or product before launch
Web, mobile or API penetration test
PT-03PT-04PT-05
If you need to
find out what attackers can see from the internet
External attack surface assessment
PT-09
If you need to
test whether your SOC would catch a real attack
Assumed breach or full-scope red team
RT-02RT-01
If you need to
improve detections quickly
Purple team workshop
PU-01
If you need to
reduce phishing and fraud risk
Social engineering campaign
SE-01SE-02SE-03
If you need to
prepare leadership for a major incident
Executive tabletop exercise
SP-03
If you need to
check a vendor or acquisition target
M&A / third-party assessment
SP-04
10 services · Announced
Penetration testing
Penetration tests find and prove exploitable weaknesses in a defined scope. They are announced to your team and built for breadth, so they suit compliance and pre-launch assurance.
| Code | Service | What we test |
|---|---|---|
| PT-01 | External network test | Internet-facing hosts, VPNs, firewalls, exposed services |
| PT-02 | Internal network test | Workstations, servers, segmentation, lateral movement from an internal foothold |
| PT-03 | Web application test | Authentication, access control, OWASP Top 10, business-logic flaws |
| PT-04 | API test | REST and GraphQL endpoints, authorization, rate limiting, data exposure |
| PT-05 | Mobile application test | iOS and Android app, local storage, backend APIs |
| PT-06 | Cloud configuration review | AWS, Azure or GCP: IAM, storage, networking, logging, attack paths |
| PT-07 | Identity and Active Directory assessment | AD, Entra ID, SSO: privilege-escalation paths, weak trusts |
| PT-08 | Wireless test | Wi-Fi encryption, guest isolation, rogue access points |
| PT-09 | External attack surface assessment | Forgotten hosts, exposed services, leaked credentials, shadow IT |
| PT-10 | CI/CD and supply-chain review | Source control, build pipelines, secrets, third-party dependencies |
5 services · Covert
Red team engagements
A red team acts like a real adversary chasing a business objective, usually without your SOC knowing. It measures detection and response, not just vulnerabilities, and suits organizations that already run regular penetration tests.
| Code | Service | How it works | Best for |
|---|---|---|---|
| RT-01 | Full-scope red team | External recon to a crown-jewel objective (payment systems, source code), emulating a relevant threat actor mapped to MITRE ATT&CK | Mature programs; annual or board-level assurance |
| RT-02 | Assumed breach | Starts from a provided laptop and user account; tests lateral movement, privilege escalation and data access | Measuring internal controls without weeks spent on initial access |
| RT-03 | Objective-based test | One focused question, such as “Can a contractor reach production?” | Validating a specific risk or new control |
| RT-04 | Threat-intel-led emulation | Replays the tactics of a group known to target your sector | “Would we catch the group that hit our peer?” |
| RT-05 | Insider threat simulation | Tests what a malicious or compromised employee could reach and exfiltrate unnoticed | Data-loss and privileged-access programs |
4 services · Collaborative
Purple team and detection readiness
Our testers work side by side with your defenders, so gaps get fixed during the engagement rather than after the report.
| Code | Service | How it works | Outcome |
|---|---|---|---|
| PU-01 | Purple team workshop | Techniques run one at a time; your SOC tunes alerts and retests live | New or improved detections, before and after coverage |
| PU-02 | Detection coverage assessment | Priority ATT&CK techniques scored as prevented, detected, logged only or missed | Coverage heat map and ranked detection backlog |
| PU-03 | Incident response drill | Unannounced live scenario testing escalation, communication and containment | IR plan gaps and improvement actions |
| PU-04 | Continuous validation | Repeatable test cases run monthly or quarterly to catch detection drift | Coverage trend reporting over time |
4 services · Scoped
Specialized services
Focused assessments for systems and decisions that a standard test does not reach.
| Code | Service | What we test |
|---|---|---|
| SP-01 | AI and LLM red teaming | Prompt injection, data leakage, unsafe tool use, guardrail bypass in AI features and copilots |
| SP-02 | OT / IoT assessment | Safety-first review of industrial and connected devices; mostly passive, change-controlled active testing |
| SP-03 | Executive tabletop exercise | Facilitated ransomware, breach or insider scenario for leadership: decisions, communications, legal and regulatory steps |
| SP-04 | M&A / third-party assessment | Rapid external and cloud exposure check of an acquisition target or critical vendor |
7 services · Continuous
GRC and continuous inspection
Most assessments check an environment once, when it first goes live. These services keep assessing networks already in operation, so configuration drift, access misuse and compromise are caught as they happen, not at the next audit.
| Code | Service | How it works | Outcome |
|---|---|---|---|
| GR-01 | Continuous network inspection | Recurring inspections of networks and sites already in operation | Ongoing assurance and a running findings register |
| GR-02 | End-to-end security posture review | User account management, hardware management and integrity, patching, and proof that technical settings are actually applied | Control-by-control status with evidence |
| GR-03 | Configuration drift and change review | Device settings reviewed after planned and unplanned changes to catch drift or possible compromise | Drift report and baseline restoration actions |
| GR-04 | Insider threat detection assessment | Tests whether you can detect insiders misusing legitimate access | Detection gaps and insider threat program improvements |
| GR-05 | Access control and need-to-know validation | Verifies each user's clearance, entitlements and need-to-know against what they can actually reach | Excess-access findings and entitlement cleanup plan |
| GR-06 | Zero trust access roadmap | Plans the move to zero trust, where each network decides what each user may see based on standardized user and data metadata | Phased roadmap and access policy model |
| GR-07 | Compliance control mapping | Maps inspection results to NIST SP 800-53, RMF, CMMC, ISO 27001 and similar frameworks | Audit-ready control matrix and remediation plan (POA&M) |
Packages
Packages bundle the most-requested services at a lower combined price than buying each on its own.
PK-02Announced
Compliance
- External and internal network test
- One web application test
- Retest
Best forPCI DSS, SOC 2, HIPAA, ISO 27001 evidence
PK-03Partly covert
Advanced
- Assumed breach
- Cloud or identity assessment
- Purple team workshop
Best forTesting internal defenses and detection
PK-04Covert
Full scope
- Full-scope red team
- Social engineering and physical
- Cloud and identity
- Purple team replay
Best forMature programs; board-level assurance
PK-05Mixed
Continuous
- Quarterly attack surface assessment
- Continuous validation
- One purple team workshop per quarter
Best forTracking security posture over time
Add-ons
Add any of these to a service or package.
AO-01
Additional retest
A further verification round beyond the included retest
AO-02
Executive briefing
On-site or virtual presentation of results to leadership or the board
AO-03
Attestation letter
A summary letter for customers, auditors or insurers confirming testing took place
AO-04
Remediation support
Hands-on help from our testers while your team fixes findings
AO-05
After-hours testing
Testing outside business hours to protect production systems
AO-06
Rush start
Engagement start within 2 weeks of signature, subject to availability
Send us your codes
List the services you are considering and a few details about your environment. We reply with a scoping call time, then a fixed quote.
Common questions
If what you need is not here, ask us directly rather than filling in a form.
Price depends on scope: the number of public IPs, internal hosts, applications and cloud accounts, the office locations, and whether testing is announced or covert. After a free 30-minute scoping call you receive a proposal with fixed pricing, a timeline and rules of engagement.
Each service has a short code, such as PT-03 for a web application test. Pick the codes that match your goal and list them when you request a scoping call. The same codes appear in your proposal, so everyone is talking about the same scope.
A penetration test is announced and built for breadth: it finds and proves as many exploitable weaknesses as it can in a defined scope. A red team acts like a real adversary chasing one business objective, usually without your SOC knowing, and measures detection and response rather than just vulnerabilities.
Lead time is typically 2 weeks for smaller engagements and 4 to 6 weeks for full-scope red teams. A rush start within 2 weeks of signature is available as an add-on, subject to availability.
Yes. Every engagement includes one retest of critical and high findings within 90 days. Further verification rounds are available as an add-on.
No. Results are reported by team or role, never by named employee.
4 services · Standalone or add-on
Social engineering and physical testing
These services test people, processes and buildings. They can be bought on their own or added to a red team. Results are reported by team or role, never by named employee.