Penetration Testing for UK HR, Payroll and Recruitment Platforms
CREST-accredited penetration testing for UK staffing and recruitment agencies, HR technology vendors, payroll SaaS providers, applicant tracking system vendors and job boards. Candidate portals, ATS and HRIS platforms, employee self-service and payroll changes, plus the CVs, ID documents and right-to-work evidence held behind them. Candidate, recruiter and client segregation throughout.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
sides we test on every recruitment or HR platform: the candidate, the recruiter or HR team, and the client, employer or manager whose access should stop at their own team.
What UK GDPR and HR Buyers Expect
UK GDPR and special category data. Candidate and employee records routinely include CVs, ID documents, and sometimes health information or diversity-monitoring answers, which can be special category data under UK GDPR. Article 32(1)(d) requires a process for regularly testing the effectiveness of your security measures. It does not name penetration testing as the method, but a test is the most direct evidence that your access controls and segregation actually work. See our GDPR penetration testing page, or read UK GDPR Article 32 directly.
Identity documents and right-to-work evidence. Recruitment platforms and HR systems store passports, driving licences and other right-to-work evidence for every candidate who reaches offer stage. These documents are a high-value target: we test who can view, download or bulk-export them, whether a recruiter or client can reach documents outside their own candidates, and whether document storage or preview features can be abused to reach files outside the intended scope.
Payroll and bank-detail changes. Payroll platforms and employee self-service portals are a common target for payroll-diversion fraud, where an attacker changes an employee’s bank details to redirect a salary or expense payment. We test the approval chain around bank-detail and payroll changes, joiner and leaver access timing, and manager-to-report visibility boundaries, and can run a phishing simulation modelled on payroll-diversion lures.
Who we test for. Staffing and recruitment agencies, HR technology and payroll SaaS vendors, applicant tracking system providers, job boards and candidate marketplaces, and employers running their own HR or employee self-service portal. Many of these platforms serve multiple client companies from one instance; see our multi-tenant SaaS penetration testing and SaaS penetration testing pages for the wider picture.
SCOPE
What We Test for UK HR, Payroll and Recruitment Platforms
Candidate Portals and ATS
Candidate-facing portals and recruiter-facing applicant tracking systems. CV and ID-document leakage, recruiter and client segregation, candidate-to-candidate access (IDOR), and bulk export of applicant records.
Job Boards and Candidate Marketplaces
Public job boards, candidate marketplaces and hiring platforms. Listing integrity, recruiter and employer permission boundaries, CV download and scraping controls, and candidate privacy across shared listings.
Payroll and Employee Self-Service
HRIS, payroll SaaS and employee self-service portals. Bank-detail and payroll-redirection controls, approval chains for changes, joiner and leaver access timing, and manager-to-report visibility boundaries.
Recruiter and Client Segregation
Multi-tenant staffing and recruitment platforms serving many client companies from one instance. Cross-client candidate visibility, delegated recruiter permissions, and what one client’s users can see of another’s requisitions.
SSO, Provisioning and Offboarding
SAML and OIDC single sign-on into HR and payroll systems, just-in-time and SCIM provisioning, and joiner, mover and leaver access changes. Whether deprovisioning removes access on the day it should.
Payroll and HR System APIs
Integrations with payroll processors, pension providers, background-check vendors and job board syndication feeds. OWASP API Top 10 with object-level authorisation on candidate and employee records.
Candidate and Employee Data in the Cloud
AWS, Azure and GCP configuration for candidate and employee data stores. Encryption at rest, IAM scoping, audit logging and multi-tenant boundaries on shared HR and recruitment platforms.
Payroll-Diversion Phishing
Targeted phishing simulation against HR, finance and payroll staff, modelled on payroll-diversion fraud and bank-detail-change requests impersonating employees or executives.
OUR PROCESS
From Scope to Attestation in 4-6 Weeks
Scoping Call
30-minute technical scoping call. Define attack surface, methodology, rules of engagement, and timeline. Fixed-price quote within 24 hours.
Active Testing
3-15 days of hands-on testing by CREST-certified pen testers, against non-production environments with synthetic candidate and employee data wherever possible. Daily status updates.
Reporting
Executive summary plus full technical report with CVSS scores, reproduction steps, screenshots, and specific remediation. 60-minute walkthrough call.
Free Retest
After remediation, we retest at no extra charge. Letter of attestation provided for buyer due diligence, cyber insurance or audit.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST HR and recruitment pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Aligned to Every Framework
Findings map to specific control references in each framework, so your audit team submits the report directly without translation work.
UK GDPR
Article 32(1)(d) evidence that you regularly test the effectiveness of your security measures.
ISO 27001
Annex A 8.8 technical vulnerability management, once you declare that control applicable.
SOC 2
Evidence for the evaluations your auditor reviews under CC4.1, commonly requested by enterprise HR and payroll buyers.
Cyber Essentials Plus
An assessor-led technical audit, not a penetration test. Certified directly by us as an IASME certification body.
Cyber Insurance
Findings and remediation documented against the questions on your proposal form. Requirements vary by insurer and policy.
Customer Questionnaires
An independent report you can attach to enterprise security questionnaires and vendor due-diligence reviews.
PRICING
Indicative Engagement Pricing
Fixed-price quotes confirmed during scoping. Free retest, executive summary, walkthrough call, and letter of attestation included.
Depends on service + scope
External / web / API / mobile single-target engagement. CREST-certified delivery. Around 3 to 5 working days from kickoff to report.
Get a fixed quoteDepends on service + scope
Multi-target combined engagement (web + API + external + AD), or single complex target. Typically 7-10 days.
Get a fixed quoteDepends on service + scope
Full-stack engagement (multiple cloud accounts, hybrid AD, complex web + API + mobile). Typically 12-15+ days.
Get a fixed quoteWHY EJN LABS
What You Get From HR, Payroll and Recruitment Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What does an HR or recruitment platform test look at that a standard web app test does not?
Candidate-to-candidate and employee-to-employee access, recruiter and client (or employer) segregation, exposure of CVs and ID documents, the approval chain around payroll and bank-detail changes, and whether joiner, mover and leaver access changes take effect on time.
How do you handle identity documents and right-to-work evidence?
We treat them as the highest-value data on the platform. Testing covers who can view, download or bulk-export them, whether recruiters or clients can reach another client’s candidates’ documents, and whether preview or storage features expose files outside the intended scope.
Can you test for payroll-diversion fraud risk?
Yes. We test the approval chain around bank-detail and payroll changes in your HRIS or payroll platform, and can run a phishing simulation modelled on payroll-diversion lures targeting HR, finance and payroll staff. See our phishing assessments page.
Can you test our recruitment platform before we onboard a new enterprise client?
Yes. Before a significant new client or a change to permissions, we test whether that client’s recruiters, hiring managers and candidates can see or act on data belonging to another client on the same platform. See our multi-tenant SaaS penetration testing page.
Is employee diversity or health data special category data?
Yes. Diversity-monitoring fields, health information and reasonable-adjustment records processed by HR systems can be special category data under UK GDPR. We test who can view or export these fields and whether access is limited to the roles that need it.
Do you test job boards and candidate marketplaces?
Yes. Job boards and candidate marketplaces get the same scrutiny as any two-sided platform: candidate privacy, recruiter and employer permission boundaries, listing integrity, and controls around CV download and bulk scraping.
What’s in the report?
Executive summary (board-ready), technical report with CVSS 3.1 scores, reproduction steps, screenshots, specific remediation guidance, and a 60-minute walkthrough call. Letter of attestation issued after free retest.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
How quickly can you start?
From signed scope to active testing in 24 hours where required. Standard pipeline is 3-5 business days from initial scoping call to test start.
Are your testers UK-based and what certifications do they hold?
Every engagement is performed by vetted UK-based CREST-certified testers matched to your engagement based on security clearance, compliance scope, and sector specialism. Testers hold CREST certifications relevant to their discipline (CRT, CCT APP, CCT INF, CCSAM).
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get my HR and recruitment pen test scope
A CREST-certified pen tester will contact you within one business day with a fixed price for your candidate, employee or payroll platform.
