Sector-Specialist Penetration Testing, Mapped to Your Regulator.

FCA and PRA operational resilience, DORA, and CBEST or STAR-FS readiness. Reports mapped to the control references your supervisor expects.

FCA SYSC, PCI DSS 4.0, PSD2 SCA and Open Banking. Payment APIs and mobile banking tested the way attackers actually chain them.

SOC 2 and ISO 27001 evidence, multi-tenant boundaries, API auth and IDOR. Answers your enterprise customers’ security questionnaires first time.

FCA and PRA alignment, Solvency II, claims data and broker integrations. Evidence for the penetration testing questions on your cyber insurance proposal form.

SRA expectations, Lexcel and client due diligence. NDA-strict engagements that protect privileged matter data and client accounts.

NHS DTAC, DSP Toolkit and UK GDPR Article 32. EHR, telehealth and medical device APIs tested in clinically safe windows.

DTAC technical security, with the previous DTAC form retired from 6 April 2026. The annual OWASP Top 10 pen test your NHS buyer checks before signing.

The annual penetration test in Guide 9 (IT protection) of the CAF-aligned toolkit, closed and retested ahead of your DSPT submission.

NCSC guidance, GDS Way cadence and evidence for CAF-aligned GovAssure reviews. Crown Commercial Service supplier and G-Cloud, serving central and local government, NHS supply chain and MOD partners.

DfE digital standards, Cyber Essentials for colleges and RPA cover conditions. MIS, remote access and the student networks that sit alongside staff systems, tested for schools, colleges and multi academy trusts.

Storefronts, checkout, vouchers, loyalty and returns on Shopify, Magento, WooCommerce and custom builds. PCI DSS Requirement 11.4 testing where card data is in scope.

RMM, PSA consoles, help desk and backup platforms: the tooling that reaches into every customer you support, and the separation between them.

Tenant and landlord portals, listings, mortgage journeys and the controls that stop a changed bank detail diverting a completion or rent payment.

Applicant tracking, candidate portals, ID and right-to-work documents, payroll changes, and the separation between recruiters, clients and candidates.

Customer and trading portals, EV charging backends, IoT fleets and OT remote access, tested with a safe plan and NIS-aware reporting.

Subscriber portals, provisioning APIs, SIM swap workflows and reseller portals, with evidence for your Telecoms Security Code of Practice work.

Care-plan and family apps, staff rotas, referral portals and casework systems, with DSPT and UK GDPR evidence for care providers and care software vendors.

Trial portals, laboratory systems, research data platforms and online pharmacy, with participant privacy and research integrity tested throughout.

Client portals, tax uploads, audit data rooms and practice management, plus the invoice and payment-instruction fraud that targets finance teams.

Passenger booking and PNR data, crew portals, maintenance platforms and the supplier and airline boundaries between them.

Traceability platforms, supplier portals, farm data and cold-chain telemetry, with provenance and recipe data protected.

Campaign managers, customer data platforms, tracking pixels and API tokens, with every brand and client kept apart.

Member portals, online elections and ballots, and accreditation platforms, with member privacy and voting integrity tested.

Ticketing, fan accounts, resale workflows and event-day check-in, tested for duplication and role abuse.

Carbon reporting portals, sensor dashboards and compliance data exchange, with report integrity and customer separation tested.

Supplier portals, lab platforms and plant monitoring, tested on the IT side with OT-safe test plans.

Engineering collaboration, maintenance portals and controlled documents for civil nuclear suppliers, with OT-safe test plans.

Parcel tracking, fulfilment platforms, depot and driver apps, with address privacy and parcel rerouting tested.

Practice management systems, pet owner portals, lab results and payments, with owner and practice data kept apart.