CREST-Certified Penetration Testing in London and the UK

We are headquartered at 44-45 Beaufort Court Admirals Way, London E14 9XL. We deliver across the whole UK; the London HQ is for clients who want face-to-face scoping or in-person workshops. Office visits welcome by appointment.

Yes, anywhere in mainland UK. On-site visits are available within 1-2 business days across most of England, and on 2-day notice for Scotland, Wales, and Northern Ireland. Particularly common for internal network testing, physical red team, paper-record discovery, and air-gapped network engagements where remote access isn’t possible.

No. There are no call-out fees, no travel surcharges, no out-of-pocket expenses for engagements anywhere in mainland UK. Travel is included in the fixed-price quote during scoping.

Standard engagements start within 24-48 hours of contract signature. On-site engagements within next business day. Emergency engagements (incident-driven, M&A urgency, regulator demand), within 4 hours via our priority pipeline.

Yes. FCA-regulated firms are a major sector for us across the UK. Our CREST-aligned methodology is pre-mapped to FCA SYSC, FG16/5 cyber resilience, FG23/3 Operational Resilience, and PRA SS1/21 outsourcing risk requirements.

Yes. UK law firms are another major sector for us, from City and Canary Wharf practices to regional centres (Manchester, Birmingham, Leeds, Edinburgh, Bristol) and boutique partnerships. We deliver SRA Cyber Standard-aligned testing, conveyancing fraud defence, partner-tier procurement evidence, and privileged-data confidentiality engagements.

Same UK day-rate pricing wherever you are: small engagements £4,000-£8,000, mid-market £8,000-£18,000, enterprise £18,000+. No location surcharge. UK day rates for CREST-certified testers are £1,100–£1,400 per day.

Yes. Face-to-face report walkthroughs at your office anywhere in the UK, or at our London HQ, are included with mid-tier+ engagements. Particularly useful for board-level briefings, audit committee presentations, and regulator preparation meetings.

Yes. We routinely produce CREST-attested testing reports for UK cyber insurance underwriting and renewal, including reports accepted by Lloyd’s market cyber syndicates and their broker partners.

Yes. UK PE / VC funds: 5-day accelerated cyber DD reviews on UK acquisition targets, with UK-timezone conference calls and face-to-face partner meetings at our London HQ or your office. Particularly common for fintech and SaaS deal flow.

Our testers are UK-based, working remotely across the country with on-site visits where the engagement requires it. We match testers to engagements by location and clearance level. SC-cleared testers available for public-sector and defence engagements.

Yes. Standard NDA before any technical detail is shared. We operate under a project-specific master agreement that includes data handling, deliverable IP, and breach notification clauses. Particularly important for sensitive UK law and financial-services clients.