Our business

We specialise in cyber security testing, this entails simulating real world cyber attacks against your information assets to identify and demonstrate risk

Our consultants have delivered assessments for many leading global organisations across a range of business sectors including financial services, energy, automotive, gambling, government, travel and technology

Why not reach out to us and we will be in touch to discuss your requirements

What we do

What we can do for you

Our typical service offerings include:

Application security

We test Internet facing and internal applications for vulnerabilities that could adversely impact your business

Mobile security

We test mobile applications, supporting API's and corporate mobile security policies for vulnerabilities and misconfigurations that would put your business and your users at risk


We test infrastructure underpinning your applications and business operations including laptops, servers, kiosks and network devices for misconfigurations and vulnerabilities

Goal orientated testing

We attempt to evade your preventative and detective controls to demonstrate pre-agreed scenarios such as stealing intellectual property, customer information or gaining access to critical application systems

Wireless security

We test wireless server and client configurations and identify rogue access points inside your organisation perimeter


We assess susceptibility to external phishing attacks, a common method used by criminals to breach your perimeter defences

Physical security

We assess the physical security controls around your sites such as RFID based access control systems and test if we can circumvent them

Check up

We perform a broad security check up that may identify areas of interest warranting closer inspection

What we test for

We look for vulnerabilities and issues such as:


Can we bypass the login mechanisms to gain unauthorised access to hosts, applications or data?


Can we access data of functions that should be reserved for another user?

Transmission security

Can sensitive data sent across the network be intercepted by a third party?

Input validation

How does your application handle malformed or malicious input? Can we bypass controls through specially crafted attacks?

Business logic

Can we circumvent the intended use, workflow or business processes of your application in ways that adversely affect your organisation?

Information disclosure

Do your systems inadvertently disclose sensitive information?


Are there misconfigurations of oversights that would allow an attacker to obtain sensitive information or gain a foothold in to your organisation?

Vulnerable libraries

Are you using software components, libraries, modules or plugins that have publicly known exploitable vulnerabilities?

Case studies

What we've done for others

Some of our interesting results:

ATM Jackpotting

We performed a walk up test of an ATM and successfully got the machine to dispense arbitrary amounts of cash. We also found that credit card numbers were written to files allowing malicious administrators to harvest them.

Smart card circumvention

A financial client implemented smart card authentication for their internal network. By compromising a Kiosk allowing smart card resets for forgotten smartcards, we gained domain administrator credentials from an unauthorised user perspective therefore circumventing the intended enhanced security.

Accessing medical documents

We managed to gain unauthorised access to sensitive medical records due to SQL injection and access control weaknesses. We also compromised the underlying web and database servers through a malicious file upload attack.

Unlimited payments

We carried out targeted attacks against key personnel demonstrating that we could raise and approve international payments of unlimited value.

Internet attack

By exploiting a 'contact us' form we took control over a web server and gained access to other hosts within the DMZ. We leveraged this access to compromise other hosts on the corporate side of the firewall and demonstrated that malicious code could be run on internal servers and workstations.

Off air

We circumvented physical security controls at a Champions League football club on a match day demonstrating that we were in a position to interfere with live television broadcasts and other important IT infrastructure.

Engagement process

How the engagement process works

Engaging us typically involves the following steps:

You reach out to us using the website contact us form
We arrange a call to discuss your testing requirements, preferred testing dates and discuss test approaches, feedback and deliverables
We issue a schedule of work outlining what we will deliver, the pre-requisites and the costs
You sign the schedule of work formally contracting us to deliver the work on the agreed dates
You ensure that the pre-requisites that are required for the assessment to go ahead are in place (i.e. user accounts, target information, site access etc.)
We deliver the test and issue a formal report, keeping you updated as issues are identified in line with your preferences.
You arrange a debrief session with us and the relevant stakeholders to discuss the issues and recommendations raised in the report ensuring that they are understood. This meeting is an opportunity to ask questions and advice for example, about your proposed action plan