CREST Accredited Tests
SecureIQ Report Platform
Free Retest Included
Peer-Reviewed Report
Penetration testing is a practical way to understand how exposed your systems, applications and infrastructure really are. It helps you identify exploitable weaknesses before attackers can use them, giving your technical teams clear evidence of what needs fixing and your senior stakeholders confidence that security risks are being tested properly. It also provides independent assurance that your security controls are performing as expected.
Our CREST-accredited penetration testing services are suitable for organisations that need assurance for compliance, supplier requirements, cyber insurance, customer due diligence or internal risk management. Whether you need to test a web application, mobile app, cloud environment or network infrastructure, we’ll help you define the right scope and provide clear, prioritised findings with practical remediation advice.
Penetration testing is usually the right next step if you need to:
We’ll help you scope the right assessment based on your systems, risk profile and reason for testing.
Identify exploitable weaknesses across your internal and external network infrastructure.
Simulate a realistic cyber attack to assess your organisation’s ability to detect and respond.
Assess the security of iOS and Android applications, APIs and supporting infrastructure.
Find security vulnerabilities in websites, portals and web applications before attackers do.
Check that systems, devices and security controls are configured to reduce unnecessary risk.
Identify security risks and misconfigurations across your cloud environment.
Affordable rates
& fixed price
proposals
Highly qualified pen
testing consultants
Remediation advice
& a free retest
CREST, ISO 9001,
ISO 27001 & Cyber Essentials Plus
Your named penetration testing consultant will test your internal and external network, using both in-depth manual and automated scanning to enable you to get ahead of cyber attacks by detecting and responding to security vulnerabilities.
We’ll discuss your testing objectives with you, confirm the testing scope and provide you with our recommendations and a quote for security testing. We can provide one-off testing or a managed testing service on a continuous basis.
If the quote is acceptable, we will sign an NDA with you and gather the details required to create a statement of work. This will set out all the details relating to the test, including the agreed scope, contacts during testing, your agreement to test and the contract terms relating to the testing services.
Penetration testing will be carried out by our CREST and Cyberscheme-qualified experts. Our testers will be available to you throughout the testing work and will contact you if they identify any critical vulnerabilities or issues that arise.
When testing is complete we’ll prepare our pen test report. This will set out an executive summary and our assessment of the risk to your organisation together with a technical report setting out details of the vulnerabilities identified, their severity and our recommendations for fixing the issues. The report will be peer-reviewed and sent to you securely.
Once you have the report, we’ll arrange a review call with you to discuss our findings and recommendations and to answer any questions you might have. We’ll remain available to you after the review call to answer any follow-up queries that might arise later.
Once you’ve remediated the vulnerabilities identified during the test, we’ll retest them for you and issue an updated report at no extra cost.
SecureIQ is Evalian’s purpose-built penetration testing tool and vulnerability tracking platform, designed to give you full visibility and control across every stage of your security testing as part of your managed penetration testing engagement.
Whether you’re running internal or external infrastructure penetration tests, a web application penetration test, configuration reviews, red teaming or a mobile app pen test, SecureIQ simplifies the process, giving you a complete picture of your organisation’s cyber risk posture.
Built for busy teams, the platform’s dashboard replaces fragmented email chains and static PDFs, so you can focus on reducing risk, not chasing information.
When you work with us, you gain access to security consultants who deliver far more than just technical expertise. Our team helps you identify real-world vulnerabilities and provides clear, practical advice to strengthen your organisation’s security posture, without the hard sell.
You can trust that every assessment is carried out by highly qualified professionals, certified by leading bodies such as CREST, Cyber Scheme, Offensive Security, SANS, ISC2 and IASME. Whether you need penetration testing, vulnerability scanning, or social engineering awareness training, we make the process straightforward, collaborative and focused on what matters most: protecting your business.
Need some help understanding the information on this form? Visit our guide to scoping a penetration test.
“Evalian has been testing our enterprise Digital Experience Platform for a couple of years now, and an delivered exemplary service. Good communication, thorough testing, and clear reports and fix recommendations.”
– Verse One
“We have used Evalian for pen testing, red teaming, ISO 27001 accreditation and incident management playbooks. Every consultant we worked with is an industry-leading expert and this is backed up by exceptional and most importantly responsive account management!”
– Asta
“We have used Evalian for a number of years to cover cybersecurity and physical office security testing. Very positive experience – comprehensive reports, professional, great communications, and fair prices. Would recommend.”
– Systra
“We used Evailian for the Cyber essentials plus and Pen testing. Both experiences were excellent. It was a straight forward process to get our requirements scoped out, What we needed to do was well defined, and communicated. The end reports gave easily understandable executive-level information as well as the operational level to resolve anything highlighted.”
– Bryan W Nash and Sons
This is your ultimate guide to understanding pen testing costs for your organisation.
Confused about where to start when scoping your penetration testing requirements? We've got you covered.
Four steps to choosing the right pen test partner for your organisation.
A penetration test is a manual security assessment of your network, systems or applications using the same techniques and tactics that an attacker would use to compromise your systems or data. Using industry-standard techniques from real-world cyber attacks, the tester identifies the vulnerabilities that a threat actor would seek to exploit based on the size of your potential attack surface and advises on the steps required to fix them to make your systems more secure. You can learn more in our detailed Guide to Penetration Testing.
Using a penetration testing services company that has CREST accreditation to carry out security assessments and penetration testing gives you the confidence that the quality of the services and the technical capability and skills of the consultants you have access to are of an internationally recognised high standard. Using a CREST-certified pen test company ensures you are being provided with reputable services and testers who are highly skilled, knowledgeable, competent and able to find not only the commonly found vulnerabilities within an infrastructure but also the really difficult-to-find vulnerabilities.
The scope of the test depends on a number of factors, including your IT architecture, the data you hold, your reasons for being tested and your budget. If you want to ensure that your most sensitive information is secure, start with systems that store this data. This could be internal file servers (an infrastructure test would be a good start) or internet-facing applications (a web application test would make sense) for example. We can help you scope the test you need. Contact us and we’d be happy to talk through the options and make recommendations.
The starting point is a discussion to scope your test requirements and understand your objectives. We’ll then provide you with a quote. If you choose to proceed, we’ll enter into an NDA with you and gather more detailed scoping information about the target systems to be tested (typically system IP addresses or URLs for web applications). We’ll use this information to create the Statement of Work (SoW) which we’ll ask you to sign to authorise us to carry out the tests on the agreed dates. Once the SoW is signed we’ll be able to start the tests and we will stay in touch with you through the process.
Your report will consist of a management summary, test information, test summary and a detailed technical report. The management summary provides an overview of the test, our recommendations and our assessment of your security risk. The remainder of the report sets out the details of the test, our findings and recommendations, including supporting evidence and links to additional materials. The report is written in plain English and is accompanied by a debrief call, during which we’ll discuss our findings and recommendations and answer any questions that you have.
Your penetration testing consultant will provide your report within seven days of completing the test. During this period, the tester analyses the test results and writes up the report, which is then peer-reviewed by the Testing Practice Lead. Following peer review, a quality assurance review is carried out and the report is authorised for release by a Director.
The cost of hiring an external penetration testing provider can widely vary depending on a number of factors such as the type of penetration test you require, whether it is a website, a web application, a mobile application and external or internal infrastructure, the number of days needed to test, and whether you need an onsite test.
Penetration testing providers can charge anywhere between £600 to over £3000 per day. Some organisations will offer a seemingly much lower price than others – but tread lightly and do your research beforehand, there is the risk that they could solely be selling automated vulnerability scanning and not offering the full detailed assessment that manual penetration testing provides, or have “bolt-on” costs for additional aspects of a test and the price can quickly shoot up.
How can you be sure what they are offering is reasonable? Make sure you collect information on potential vendors, check credentials and find evidence of reviews and case studies. To learn more about penetration pricing, read our comprehensive guide to penetration testing costs in the UK.
On the surface, a red team assessment looks similar to a penetration test, but it goes further.
Where penetration testing is a type of security assessment, using a combination of tools and manual exploit techniques to identify vulnerabilities within your IT infrastructure, a red team assessment mimics a real-life attacker, without time limitations using tactics, techniques and tools together to access systems or data.
Read more in our extensive blog: Pen Testing vs Red Team Testing
