Talk to us
Menu

Services · Audit

Penetration testing

Authorised testing of your applications and networks, under a signed scope, to find weaknesses before attackers do.

A penetration test shows how your defences hold up against a real attempt to break in, carried out safely and only with written permission from the system owner. We agree the scope, timing and rules of engagement in writing before any testing starts. Each finding is reproduced, rated and explained with a fix, and we retest once you have made changes.

What you get

  • A signed scope and rules of engagement listing targets, dates, methods and contacts
  • Testing of the agreed web apps, APIs, mobile apps, cloud setup or networks
  • An executive summary in plain language for leadership
  • A technical report with steps to reproduce, evidence and severity per finding
  • A recommended fix for every finding, mapped to OWASP or CWE references
  • A retest of fixed findings and an updated report showing what is resolved

How it works

  1. 01

    Authorise

    Scope, test windows, exclusions, emergency contacts and the owner’s written permission are signed first.

  2. 02

    Test

    We test only what is in scope, with methods agreed in advance, following OWASP and similar methodologies.

  3. 03

    Report

    Every finding is verified, rated by severity and explained with evidence and a fix your team can act on.

  4. 04

    Retest

    After you fix the issues, we test them again and confirm in an updated report which are resolved.

Scope it now.

Answer a few questions and we prepare the email for you. Nothing is sent until you press send in your own email app.

Prefer to write freely? hello@clockborn.com

What should be tested?
How much will testers be told?
Who owns and hosts the systems?
Do you need a retest?

Questions

Can you test a system we do not own?

No. We test only systems whose owner has given written permission, and hosting or cloud provider policies must also allow it. If a third party hosts part of your system, we help you get their approval or exclude it from scope.

Will testing disrupt our systems?

We avoid destructive tests and denial of service unless you request them in writing. The rules of engagement set testing hours and a contact on each side, and we stop immediately if anything unexpected affects your service.

How is this different from a vulnerability scan?

A scan runs automated checks for known issues and often reports false positives. A penetration test adds manual work: confirming findings, chaining weaknesses, testing business logic and access rules, and showing what an attacker could actually reach.

Related services

Code reviewAn independent review of your codebase, with clear findings ranked by risk and a recommended fix for each.Security hardeningServers, cloud accounts, devices and apps locked down against a recognised benchmark, with every change recorded.Managed securityDefensive monitoring of your systems, with alerts triaged and incidents contained by people who know your setup.Security consultingAn independent view of your security weaknesses and a prioritised, practical plan to fix them.

Software it applies to

Application securitySecurity checks built into the delivery pipeline, so flaws are caught in pull requests, not production.Vulnerability managementA single list of known weaknesses across your own systems, ranked by real risk and tracked until fixed.Network securityFirewalls, segments and remote access managed as code, with traffic visibility to prove the rules work.

Language · 42