CREST, CSTM and OSCP qualified penetration testers. London-based.
A penetration test is only as useful as the people carrying it out. Automated scans find the obvious. Real attackers chain together the things that look harmless on their own. Every Forensic Control penetration test is delivered by CREST, CSTM and OSCP qualified testers using a methodology built on NIST Special Publication 800-115 and the Penetration Testing Execution Standard (PTES).
Forensic Control has been delivering cyber security services for UK organisations since 2008. We are an authorised IASME Certification Body, which means the same team that scopes your pen test can sign your Cyber Essentials Plus certificate at the end of it. No handoffs, no second supplier.
We scope each engagement to the systems and threat scenarios that matter for your business. Pricing is by scope, not by tester-day, so we can give you the cost before testing begins. The six services below cover our standard catalogue; if your requirement doesn’t fit neatly into one of them, get in touch and we’ll scope something bespoke.
Your public-facing systems are the most exposed part of your estate and the first target most attackers reach for. We test from outside the network against your public IP ranges and exposed services, identifying what an internet-based attacker can see, reach and exploit. Findings are CVSSv3-rated with clear remediation steps.
Most successful breaches don’t end at the perimeter — they begin there. An internal pen test starts from inside the network, simulating an attacker who already has a foothold (a stolen credential, a compromised endpoint, an opportunistic insider). We map lateral movement paths, escalate privileges where we can, and report exactly how far an attacker could reach.
If your business builds or maintains custom web applications, those applications are your largest attack surface. We test authentication, session management, authorisation logic, input handling, business-logic flaws and the trust boundary between client and server. Most clients opt for grey-box testing using staging credentials — the most realistic and cost-effective approach.
A mobile app is three things at once: the binary on the device, the data it stores locally, and the APIs it talks to. We test all three across iOS and Android — looking at how credentials are stored, how data is transmitted, whether the supporting APIs can be abused independently of the app, and what an attacker with a reverse-engineered build could learn.
Technical controls only matter if the people behind them aren’t tricked into bypassing them. A social engineering engagement tests the human layer: targeted phishing campaigns, voice-based pretexting, and tailored scenarios drawn from publicly available information about your business. The output tells you which controls held, which didn’t, and where to focus training.
A red team engagement is a goal-oriented attack simulation: agree an objective (“exfiltrate finance data”, “gain domain admin”, “compromise the CEO’s mailbox”) and let a team of testers chain together every technique an advanced attacker might use to achieve it. Longer, broader and stealthier than a standard pen test. Best suited to organisations with mature security programmes that want to test their detection and response capability.
Our penetration testing methodology is built on NIST Special Publication 800-115 and the Penetration Testing Execution Standard (PTES). A typical engagement follows the six stages below, with a CREST, CSTM or OSCP qualified tester leading the work from start to finish.
Client goals, scope and rules of engagement agreed. Senior FC staff lead this conversation.
Open-source intelligence on the target systems to inform the testing approach.
Automated and manual enumeration to map potential entry points.
Entry points probed using manual and automated techniques.
Potential vulnerabilities confirmed through manual exploitation.
CVSSv3-prioritised findings with daily updates during testing.
Each engagement produces a written report and a set of deliverables designed to be useful both to the board and to the IT team or MSP that has to act on them.
Written for non-technical readers. The board and senior leadership can act on this section without reference to the technical detail.
Every vulnerability prioritised by Common Vulnerability Scoring System v3 risk rating, with evidence, location and reproduction steps.
Clear proof of concept content showing how each vulnerability can be replicated. Useful for the team remediating the issues.
Clear remediation guidance for every finding, with full hands-on support for critical and high-risk vulnerabilities at no extra cost.
If a high or critical vulnerability is discovered during testing, you hear about it that day. Urgent issues can be addressed in parallel.
Once the report is delivered, we schedule a call or video conference to walk through the major findings with your team.
Once you have remediated findings, we retest to confirm the fix. Included in scope, not charged separately. Report updated post-retest.
Once retesting is complete, you receive a Certificate. Useful for client due diligence, supplier questionnaires, cyber insurance and ISO 27001 evidence.
Every engagement is delivered by CREST, CSTM and OSCP qualified penetration testers using a methodology built on NIST 800-115 and PTES. No junior testers, no offshore work, no being passed between accounts.
Findings reported in plain English and prioritised by CVSSv3, with proof of concepts and remediation steps for every issue. A walkthrough call with your team once the report is delivered, and a Penetration Testing Certificate once everything is resolved.
Scoping is the stage where most pen tests succeed or fail. Senior Forensic Control staff lead every scoping conversation, drawing on investigative-grade experience from New Scotland Yard to focus the engagement on the threats that actually apply to your business.
We are an authorised IASME Certification Body. If your pen test is feeding into a Cyber Essentials Plus certification, ISO 27001 audit or SOC 2 readiness, the same team that scopes the test signs the certificate or supports the audit. No handoffs.
A penetration test and a vulnerability scan look at the same problem from different angles. Most organisations need both: scanning monthly, pen testing once a year or after a significant change.
Jonathan and his team delivered exceptional security testing services for our organisation. Their thorough assessment confirmed our robust security controls. Communication was clear throughout the process, and their detailed reports provided valuable documentation of our security posture. The team’s technical expertise was impressive, and they worked efficiently without disrupting our operations. Highly recommend their services to any company looking to validate their security measures!
44 reviews
Whether you are running a pen test for the first time, renewing an annual engagement, or testing in advance of a Cyber Essentials Plus or SOC 2 audit, we can scope it on a 15-minute call.
Contact an Expert
