Is this the same thing as a penetration test?

No, and the difference matters commercially. An assessment records that a weakness exists and explains what it would cost you if it were used. A penetration test proves what an attacker could actually reach with it, and is a larger and more expensive engagement. When a pen test is being asked for by a customer or an auditor, their wording would often be satisfied by an assessment — so the first question we ask is who asked, and what their exact words were.

Do you need written permission even for a review that only looks?

Yes. Scanning and probing a system without the owner's written authorisation is an offence under the Computer Misuse Act in the UK and the CFAA in the US, and intent is not a defence. Before anything runs we agree a short scope document naming the systems in and out of scope, the dates, and who signed it. If a system is hosted by a third party, their permission may be needed as well as yours.

What do we actually receive at the end?

An executive summary written for someone non-technical, a risk register with likelihood, impact, owner and rough effort for every finding, a detailed section for each high and medium item with the evidence and the fix for your exact platform, a list of what is already good, and a ninety-day plan. Then a call to walk through it, because a report nobody explains is a report nobody reads.

Will you fix what you find, or just report it?

Either, but they are priced separately and deliberately so. Reading a report and doing the work are two different jobs, and the remediation is usually the larger one. You may want the report because a third party demanded it and your own developer will act on it, or you may want us to carry it through. We will quote both so you can see the difference.

Will the report say we are secure?

No, and you should be wary of anyone whose report does. Every assessment we write carries the same line — this is a review of the position on this date, and systems change, so it is a snapshot rather than a lasting guarantee. What the report will say is which routes in are now closed, which risk has been reduced, and what remains open.

How much disruption is there for our team?

Less than people expect for the technical part, more than they expect for the administrative part. The reviewing is read-only and largely invisible. The time cost falls on whoever has to grant access, find out who owns which account, and answer questions about how things actually work. Delays in that are the main reason this kind of work slips.

Cybersecurity

Security audit and vulnerability assessment

Your systems reviewed, every finding checked by hand, and a short list of what to fix first — ranked by what it would cost your business, not by scanner severity.

From: $800–$10,000
Typical time: 1–4 weeks
Usually bought by: Any company

What this actually solves

Three situations bring a company here, and they arrive at very different speeds.

The first is a demand from somewhere else. A large customer has sent a security questionnaire, an insurer wants to know what is in place before it renews, or a procurement team has asked for evidence that somebody independent has looked. Nothing has gone wrong. Something has simply stopped moving, and it will not move again until there is a document.

The second is fear with a specific cause. A company in the same trade — often one the owner knows personally — has just lost money to a redirected invoice or had its site taken down for a fortnight. Nothing has been found here. But the question "would that have worked on us" has no answer, and it stops being an abstract question at about two in the morning.

The third is inheritance. A new system, a new team, an acquired company, a developer who has left and taken the only mental map with him. Somebody now owns something they have never looked inside.

All three are buying the same thing, and it is not a PDF. It is the ability to stop thinking about it — to know which three things are genuinely dangerous, which of the rest are noise, and what the next ninety days should contain. Being clear about the boundary is part of that: this work records that a weakness exists and explains its business consequence. It does not exploit anything. Proving what an attacker could reach is penetration testing, a separate and more expensive engagement, and this is the work that comes first.

How the assessment runs

Scope and written authorisation. Systems named one by one, with an equally explicit list of what is excluded — staff personal devices, third-party providers' own infrastructure, anything not on the list. Signed before anything is touched. Half a day to a day.
Asset inventory. Every domain, server, SaaS account and administrator login, written down in one place. This is frequently the most valuable single deliverable, because nobody maintains that list and what surfaces on it is genuinely surprising — old subdomains still resolving, tools nobody has logged into for two years, admin accounts belonging to people who left. Two to four days.
Read-only configuration review. Who holds administrator rights in each system, and how many of them still work here. Where multi-factor authentication is and is not switched on, starting with the domain registrar, the email admin console and the hosting account. Whether a backup exists, how old it is, and whether anyone has ever actually restored one. How far behind the CMS, plugins and operating system are. Certificate expiry. Whether SPF, DKIM and DMARC exist on the sending domain. Where the logs are and how many days they hold. And where customer data has quietly spread to — a spreadsheet, someone's personal drive, a chat group. Two to five days.
Scanning inside the agreed scope, then verification by hand. Dependency checks with npm audit, pip-audit or Trivy, the cloud provider's own scoring where it applies, and a network scanner such as Nessus or Greenbone only where a network is in scope and authorised. Every result that will appear in the report is confirmed manually first. Two to four days.
Ranking, report and a walkthrough call. Findings sorted into this week, this month, and when there is budget — with three to five items in the first bucket and no more. Each one written as what it is, what it puts at risk in business terms, and the specific fix for your platform. Two to three days.

One check worth naming, because it is small and it is often the most valuable line in the report. Asking DNS for the DMARC record of a domain — dig +short TXT _dmarc.yourdomain.com — and getting nothing back means anyone in the world can send email that appears to come from your company, and that most recipients will find it convincing. That is the mechanism behind supplier-invoice fraud, and it is a configuration change rather than a project.

What moves the price

The range is $800–$10,000 across 1–4 weeks, and three things decide where an engagement lands inside it.

How much there is. One website is one job. A sixty-person office with its own network, file server, printers and laptops is a fundamentally different one, and the range reflects that gap rather than a discount ladder.

Whether cloud infrastructure is in scope. Reviewing identity, storage permissions, network rules and logging inside a cloud account is a distinct body of work with its own tooling, and adding it changes the shape of the engagement rather than adding a few hours.

Whether remediation is included. Report only sits at the lower end. Report plus doing the work sits at the upper end, because the fixing is the larger body of work. Price also rises when the report is written to be handed to a third party — an auditor, an enterprise customer, an insurer — because the standard of evidence that recipient expects is higher than the standard an internal reader needs.

What usually goes wrong

The scanner's output becomes the report. A network scanner will happily produce a document longer than anyone will read end to end, because it lists everything it recognises without judging whether any of it applies to this company. Handed over raw, it does one thing reliably — it frightens you into doing nothing, while making it obvious that all anybody did was press a button.

Findings go out without being verified. The classic is a version string. The scanner reports an outdated web server; the Linux distribution backported the security patch months ago and left the version number alone. It goes in the report, your own developer disproves it immediately, and every other finding in the document — including the ones that were real — now carries an asterisk.

Everything is marked urgent. Forty findings, all flagged as important, is the same as no findings at all, because nobody can start. The judgement being paid for is which three to five of them actually change the company's exposure this week, and the willingness to put the rest below the line and say so.

See where the site stands before you brief anyone.

If the site is already live, start from what it scores rather than from a guess. The audit reports what it checked, what it found, and — the part most tools leave out — what it could not check, and why.

See the website audit Talk about this work

Questions people ask before they commit.

Is this the same thing as a penetration test?: No, and the difference matters commercially. An assessment records that a weakness exists and explains what it would cost you if it were used. A penetration test proves what an attacker could actually reach with it, and is a larger and more expensive engagement. When a pen test is being asked for by a customer or an auditor, their wording would often be satisfied by an assessment — so the first question we ask is who asked, and what their exact words were.
Do you need written permission even for a review that only looks?: Yes. Scanning and probing a system without the owner's written authorisation is an offence under the Computer Misuse Act in the UK and the CFAA in the US, and intent is not a defence. Before anything runs we agree a short scope document naming the systems in and out of scope, the dates, and who signed it. If a system is hosted by a third party, their permission may be needed as well as yours.
What do we actually receive at the end?: An executive summary written for someone non-technical, a risk register with likelihood, impact, owner and rough effort for every finding, a detailed section for each high and medium item with the evidence and the fix for your exact platform, a list of what is already good, and a ninety-day plan. Then a call to walk through it, because a report nobody explains is a report nobody reads.
Will you fix what you find, or just report it?: Either, but they are priced separately and deliberately so. Reading a report and doing the work are two different jobs, and the remediation is usually the larger one. You may want the report because a third party demanded it and your own developer will act on it, or you may want us to carry it through. We will quote both so you can see the difference.
Will the report say we are secure?: No, and you should be wary of anyone whose report does. Every assessment we write carries the same line — this is a review of the position on this date, and systems change, so it is a snapshot rather than a lasting guarantee. What the report will say is which routes in are now closed, which risk has been reduced, and what remains open.
How much disruption is there for our team?: Less than people expect for the technical part, more than they expect for the administrative part. The reviewing is read-only and largely invisible. The time cost falls on whoever has to grant access, find out who owns which account, and answer questions about how things actually work. Delays in that are the main reason this kind of work slips.

Often taken together.

Start with the brief, not the invoice.

Send what you are trying to achieve. You get a written scope, a price and a date — or an honest “this is not the right service for that”.

Talk about Security audit & vulnerability assessment All Cybersecurity services