Penetration Testing

Penetration Testing Guides

CREST-registered penetration testing guides covering methodology, scoping, common findings, and remediation across web, network, and mobile.

21 guides · Browse all categories →

Penetration Testing

Configuration Review: What It Is and Why It's Part of a Security Assessment

What a configuration review tests, how it differs from a vulnerability scan, and what it reveals about your actual security posture. Written by a CREST-registered pen tester.

5 min read

Read Guide

Penetration Testing

Infrastructure Pen Testing: What We Actually Test on Your Network

External scans tell you half the story. Here is what a CREST tester checks on your internal network, servers, and Active Directory.

10 min read

Read Guide

Penetration Testing

Penetration Testing FAQ: What Buyers Actually Ask Us

Straight answers to the questions businesses ask before buying a pen test. CREST, CHECK, cost, timing, and what the report looks like.

10 min read

Read Guide

Penetration Testing

Penetration Testing: What UK Businesses Need to Know

A pen test is not a scan. This guide explains what penetration testing involves, when you need one, and what to look for in a tester.

9 min read

Read Guide

Penetration Testing

Social Engineering Testing: What It Involves and When You Need It

Phishing simulations are one part. Real social engineering testing covers phone calls, physical access, and the human decisions no scanner checks.

9 min read

Read Guide

Penetration Testing

Types of Penetration Testing: Which One Do You Need?

External, internal, web app, API, wireless, social engineering. Each type of pen test checks different things. This guide explains which ones matter for your business.

6 min read

Read Guide

Penetration Testing

Vulnerability Assessment vs Penetration Testing: What's the Difference?

A vulnerability assessment finds known weaknesses. A penetration test exploits them. Both are useful, but they are not interchangeable.

6 min read

Read Guide

Penetration Testing

Active Directory Attacks Explained: What We Find on Internal Networks

Active Directory attacks are among the most common findings on internal pen tests. Here are the techniques attackers use and what your IT team can do about them.

9 min read

Read Guide

Penetration Testing

Building AI-Assisted Security Assessments

How AI is being integrated into Cyber Essentials and pen testing assessments. What it speeds up, what it can't replace, and where the line sits.

11 min read

Read Guide

Penetration Testing

10 Cybersecurity Areas AI Is Already Changing

AI is changing how attacks happen and how defences work. Ten areas where it matters now, assessed honestly by a pen tester.

11 min read

Read Guide

Penetration Testing

AI in Cybersecurity: What's Real, What's Marketing, and What Matters

A pen tester's honest assessment of where AI genuinely changes cybersecurity and where vendors are just rebranding old tools.

9 min read

Read Guide

Penetration Testing

Can AI Actually Do a Pen Test?

AI tools find known vulnerabilities. Pen testers find the things no scanner checks for. The difference costs money when it matters.

9 min read

Read Guide

Penetration Testing

API Security Testing: What a Pen Tester Actually Checks

Most API tests are automated scans with a report. Here is what a CREST tester actually checks and why it matters.

7 min read

Read Guide

Penetration Testing

Automated Compliance Monitoring with Playwright and N8N

How we use Playwright and N8N to automate Cyber Essentials compliance checking. Continuous monitoring instead of annual surprises.

10 min read

Read Guide

Penetration Testing

CREST Pen Testing Explained

What CREST certification means for penetration testing, the difference between individual and company accreditation, and why it matters when choosing a tester.

11 min read

Read Guide

Penetration Testing

How We Allocate Pen Testing Days

What determines how many days a pen test takes. Scope, assets, methodology, and the questions to ask before you get a quote.

10 min read

Read Guide

Penetration Testing

The HTTPS Fallacy: Why the Padlock Means Less Than You Think

HTTPS encrypts the connection. It says nothing about who you're connected to. A pen tester explains why the padlock is not a trust signal.

10 min read

Read Guide

Penetration Testing

How We Recreate Real Vulnerabilities in Our Lab

Most pen testers never show you what they actually find. We recreate real penetration testing findings in a controlled lab so you can see what we look for without exposing client data.

10 min read

Read Guide

Penetration Testing

LLMNR and NBT-NS Attacks: What Your IT Team Should Know

LLMNR and NBT-NS are enabled by default on Windows. Attackers use them to capture password hashes on internal networks. The fix takes minutes.

10 min read

Read Guide

Penetration Testing

How Much Does a Pen Test Cost in the UK?

What penetration testing actually costs in the UK and what drives the price. Day rates, scope factors, and how to tell a real test from a rebranded scan.

10 min read

Read Guide

Penetration Testing

Web App Pen Testing: What Gets Tested and Why It Matters

Web application testing checks the things your scanner can't see. Authentication flaws, access control gaps, and the business logic mistakes that cost money.

7 min read

Read Guide

Other categories

Research & Intelligence →