Contact Us

Contact Us

Please get in touch using the form below

Side Pop-out Form
reCAPTCHA
View our full Privacy Policy
Assess

Penetration Testing

What is penetration testing?

Penetration testing (pentesting) is the process of assessing computer systems, networks and applications to identify and address security vulnerabilities that could be exploited by cybercriminals.

Redscan is an award-winning provider of cyber security penetration testing services. Our range of CREST approved ethical hacking engagements enable organisations of all sizes to effectively manage cyber security risk by identifying, ethically exploiting, and helping to remediate vulnerabilities that could lead to network, systems, applications and personnel being compromised by malicious attackers.
 

Does my organisation need a pen test?

With threats constantly evolving, it’s recommended that every organisation commissions penetration testing at least once a year, but more frequently when:

 

• Making significant changes to company infrastructure

• Launching new products and services

• Undergoing a business merger or acquisition

• Preparing for compliance with data security standards

• Utilising and/or developing custom applications

Benefits
of regular penetration testing

Regular pen testing helps improve your cyber security by:

  • Fixing vulnerabilities before they are exploited by cybercriminals
  • Providing independent assurance of security controls
  • Improving awareness and understanding of cyber security risks
  • Supporting PCI DSS, ISO 27001 and GDPR compliance
  • Demonstrating a continuous commitment to security
  • Supplying the insight needed to prioritise future investments
Cyber security attacks

How effective is your cyber security?

Cyber security attacks

With threats continuing to grow in both volume and sophistication, performing a pentest to understand how an attacker might breach your business’ defences and the appropriate action needed to address the risk is an important part of effective cyber security.

 

Insecure network configurations, authentication problems, as well as flaws in application source code and logic, are just three in a long line of underlying vulnerabilities that could be exploited by criminal hackers. With your organisation’s attack surface continuing to grow, keeping out the bad guys is an uphill struggle.

 

Using real-life adversarial techniques to identify common and complex vulnerabilities, Redscan’s team of certified ethical hackers can help your organisation to clearly understand its weaknesses and develop a strategy to address them.

 

By identifying and exploiting vulnerabilities that evade automated online assessments, and providing clear help and advice to remediate issues, Redscan’s ethical hacking and security penetration testing services enable you to understand and significantly reduce your cyber security risk.

 

All Redscan’s pen testing engagements are client confidential and unlike a real cyber-attack cause no damage or disruption.

Show more
Computing Security Awards Winner
SC Award Winner Best Customer service
CREST penetration testing

Frequently
asked
questions

What is a pen test?

A penetration test is a form of ethical cyber security assessment designed to identify and safely exploit vulnerabilities affecting computer systems, networks, applications and websites so that any weaknesses discovered can be addressed in order to mitigate the risk of suffering a malicious attack.

What's the difference between pen test and vulnerability scan?

While a vulnerability scan uses only automated tools to search for known vulnerabilities, a penetration test is a more in-depth assessment. Pentesting utilises a combination of machine and human-driven approaches to identify hidden weaknesses.

Who performs a penetration test?

Penetration testing is conducted by Redscan’s experienced red team of CREST accredited ethical hackers who possess an in-depth understanding of the latest threats and techniques.

What are the steps involved in a pen test?

Penetration testing services use a systematic methodology. In the example of a network test, once the engagement has been scoped, the pen tester will conduct extensive reconnaissance, scanning and asset mapping in order to identify vulnerabilities for exploitation. Once access to the network has been established, the pen tester will then attempt to move laterally across the network to obtain the higher-level privileges required to compromise additional assets and achieve the objective of the pentesting engagement.

How is a penetration test conducted?

Penetration testing utilises the tools, techniques and procedures used by genuine criminal hackers. Common blackhat methods include phishing, SQL injection, brute force and deployment of custom malware.

What penetration testing tools are typically used?

Redscan’s penetratration testers don’t rely on automated scanning applications. To detect hidden and complex vulnerabilities, they leverage a range of open source and commercial pentesting tools to manually perform tasks such as network and asset discovery, attack surface mapping and exploitation.

How long does a pentest take?

The time it takes an ethical hacker to complete a pentest is dependent upon the scope of the test. Factors affecting duration include network size, if the test is internal or external facing, and whether network information and user credentials are shared with Redscan prior to the pentesting engagement.

How often should pen testing be carried out?

All businesses are advised to conduct a penetration test at least once a year, as well as after any significant upgrades or modifications to the company network. Given the rapid rate at which new exploits are discovered, Redscan recommends that quarterly tests are performed. Regular penetration tests are often required for compliance with regulations such as PCI DSS.

What happens after the pen testing is completed?

After each engagement, the ethical hacker(s) assigned to the test will produce a custom written report, detailing and assessing the risks of any weaknesses identified plus outlining recommended remedial actions. A comprehensive telephone debrief is conducted following submission of the report.

Can a pentest be performed remotely?

Many types of penetration testing can be performed remotely via a VPN connection, however some forms of assessment, such as internal network pen tests and wireless pen tests, may require an ethical hacker to conduct an assessment on site.

Should I use the same penetration testing supplier?

Working with a single supplier can have its pitfalls, as over-familiarity with an IT environment can mean that some exposures may be overlooked. Choosing a partner like Redscan, that invests in offensive security and employs ethical hackers specialising in a wide range of penetration testing types, can help to significantly reduce this risk while offering the added benefit of being a long-term, go-to, partner for support and advice.

Why is it important to use a CREST pentesting company?

Redscan is a member of CREST, an international certification body for information security and pentesting. By choosing our CREST accredited penetration testing services, you can be sure that all assessments will be carried out to the highest technical and ethical standards. Our CREST certified penetration testers hold a range of cyber security certifications, demonstrating their ability to perform many types of penetration testing.

Will a pen test affect business operations?

A Redscan penetration test is conducted in accordance with the strictest professional and ethical standards. Tests are designed to identify and safely exploit vulnerabilities while minimising the risk of disrupting everyday business.

How much does a pen test cost?

The cost of a pentest is based on the number of days needed by our ethical hackers to achieve an agreed objective. A custom quotation is produced upon completion of a pen test scoping form.

Types of penetration test

Network testing

Redscan rigorously investigates your network to identify and exploit a wide range of security vulnerabilities. This enables us to establish if assets such as data can be compromised, classify the risks posed to your overall cyber security, prioritise vulnerabilities to be addressed, and recommend action to mitigate risks identified.

Learn more about our network penetration testing services.

Web application security testing

Websites are essential for conducting business in today’s competitive digital economy. With one in every five pounds spent online, protecting your systems and data, including the personal details of customers, is vital for avoiding brand and reputational damage as well as ensuring compliance with PCI-DSS.

Redscan’s ethical hacking services include website penetration testing to identify vulnerabilities including SQL injection and cross-site scripting problems plus flaws in application logic and session management flows.

Learn more about our web app pen testing services.

Social engineering

Human behaviour continues to be one of the weakest links in an organisation’s cyber security. Redscan’s customisable pen test service includes a range of vishing and phishing attacks designed to assess detection of spurious phone calls and email messages designed to trick employees into disclosing sensitive information and performing malicious actions.

Learn more about our social engineering services.

Wireless testing

Unsecured wireless networks can enable attackers to enter your network and steal valuable data. Wireless penetration testing identifies vulnerabilities, quantifies the damage these could cause and determines how they should be remediated.

Learn more about our wireless penetration testing services.

Application and API security code review

Security vulnerabilities contained within software are commonly exploited by cyber criminals and are easily introduced by under-pressure programmers that cut corners. Redscan’s ethical hackers conduct automated and manual penetration tests to assess backend application logic and software and API source code.

Learn more about our web app testing services.

Mobile security testing

Mobile app usage is on the rise, with more and more companies enabling customers to conveniently access their services via tablets and smartphones. Redscan carries out in-depth mobile application assessments based on the latest development frameworks and security testing tools.

Learn more about our mobile application testing services.

Firewall configuration review

Firewall rule sets can quickly become outdated, which increases information security risk. By attempting to breach your organisation’s firewalls, Redscan’s penetration testers can detect unsafe configurations and recommend changes to optimise security and throughput.

Learn more about our build and configuration review services.

Host configuration review

Host security is a fundamental part of cyber defence. Redscan’s penetration testing services assess whether a host’s operating systems and applications have been appropriately hardened to provide protection against advanced system threats.

Learn more about our mobile security testing services.

Computing Security Awards Winner
SC Award Winner Best Customer service
CREST penetration testing

Reasons to choose Redscan

  • One of the highest accredited UK penetration testing companies
  • A deep understanding of how hackers operate
  • Complete post-test care for effective risk remediation
  • In-depth threat analysis and advice you can trust

Our qualifications

Pen Test Certs v3

Redscan’s London based team of ethical hacking experts possess the skills and experience to identify the latest threats.

CREST Registered Tester (CRT), CREST Simulated Targeted Attack and Response (STAR), CREST Certified Web Application Tester (CCT APP), CREST Certified Infrastructure Tester (CCT INF), CREST Certified Simulated Attack Manager (CC SAM), CREST Certified Simulated Attack Specialist (CC SAS), Offensive Security Certified Professional (OSCP), Tiger Scheme Qualified Security Team Member (QSTM), Certified Ethical Hacker (CEH), Certified Information Systems Security Professional (CISSP), CISSP Information Systems Security Architecture Professional (CISSP-ISSAP), Certified Information Systems Auditor (CISA), Certified Information Systems Manager (CISM), Cisco Certified Network Associate (CCNA), Cisco Certified Design Associate (CCDA) and SourceFire Certified Professional (SFCP).

Our approach

Penetration testing methodology

Redscan’s security penetration testing services are based on a systematic approach to vulnerability detection and reporting. Our advanced pentest methodology includes:

Scoping

We work with you closely to define all assets that fall within the scope of the pen test

Reconnaissance and intelligence gathering

We gather publicly available information using open source techniques (OSINT) and leading security exchanges like CiSP to build intelligence that could be used to compromise your business

Active scanning and vulnerability analysis

We conduct a full assessment of network infrastructure and applications to obtain a complete picture of your organisation’s attack surface

Mapping and service identification

We research and gather detailed information about target systems

Application analysis

We perform an in-depth audit of applications residing on target hosts to identify security vulnerabilities to exploit

Service exploitation

We attack identified vulnerabilities to gain access to target systems and data

Privilege escalation

We attempt to compromise a privileged account holder, such as a network administrator

Pivoting

We use compromised systems as a mechanism to attack additional assets

Reporting and debrief

We provide a manually-written pentest report that includes an executive summary and recommendations on how to effectively address identified risks

What our customers say
4.8/5 - based on 51 Reviews
Get a Pen Test Quote Now
Please fill out the form below and we will get back to you as soon as possible
On Page Contact Form Without Download
Redscan would like to keep you informed about our services. Please tick the options below to receive occasional updates via
reCAPTCHA

You can unsubscribe at any time.
View our full Privacy Policy

Pen Testing Solution of The Year 2018
Pen Testing news

DOWNLOADS

Redscan overview brochure

Our Pen Testing datasheet

Our Assess services datasheet

A pen testing case study with WMBA

FURTHER INFORMATION

BLOG

Google’s annual ‘Year in search’ report offers fascinating insights into people’s online search behaviour. At Redscan, we’ve set about using Google Trends data to demonstrate how the cyber …

Case Study

King Edward VII's Hospital

A private hospital with royal patronage chose ThreatDetect™, Redscan’s Managed Detection and Response service, to protect patient data through proactive network and endpoint monitoring.

Get a pen test quote

Please fill out the form below and we'll get back
to you shortly to discuss your testing requirements.
Popup Form
View our full Privacy Policy

We use cookies for security, to optimise your browsing experience and anonymously analyse site traffic.
Accepting necessary cookies is required to provide you with a minimum level of service. Learn more