Resources

Practical security buying guides.

Guides for teams using penetration testing to support compliance, product assurance and security decision-making.

ISO 27001 pentest evidence

How penetration testing supports ISO 27001 evidence, risk treatment and audit readiness, with practical guidance for SaaS and technology teams.

Practical SOC 2 penetration testing guidance for SaaS teams that need security evidence, remediation tracking and audit-ready reporting.

A practical API penetration testing checklist covering REST, GraphQL, authentication, object authorisation, rate limits and data exposure.

Compare penetration testing subscriptions and one-off pentests for SaaS, compliance and fast-changing product teams.

A practical guide to UK penetration testing costs, what changes the price, and when a subscription is better than separate one-off tests.

Practical PCI DSS penetration testing guidance for teams that need internal, external and segmentation testing evidence.

What external penetration testing covers, how to scope internet-facing assets, and what a useful external pentest report should prove.

A practical guide to internal penetration testing, assumed-breach starts, Active Directory, lateral movement and reporting.

Active Directory penetration testing guidance covering privilege paths, ADCS, Kerberoasting, delegation, lateral movement and remediation evidence.

What an AWS security review should cover across IAM, public exposure, storage, logging, networking, workloads and secrets.

GraphQL API penetration testing guidance covering introspection, object authorisation, batching, query depth, resolver behaviour and data exposure.