Vulnerability management
Ongoing discovery and prioritisation between tests.
Full details →A controlled attack on your systems so you see the weaknesses a criminal would use. Clear, prioritised reports for businesses in Leicester, Nottingham, Derby and across the East Midlands.
Penetration testing, often called a pentest, is a simulated cyber attack against the systems you agree to put in scope. It is not a generic vulnerability scan. A tester tries to exploit weaknesses the way an attacker would, then stops before any real harm, and explains what they reached and how.
Cyber Root’s testers combine automated discovery with manual work, following recognised methods such as the OWASP testing guide for web applications and a scoped, agreed rules-of-engagement for networks. You receive a risk-rated report with evidence and a practical order of fixes, then a walkthrough with your team if you want one.
Businesses across Leicestershire, Nottinghamshire and Derbyshire usually commission a test before a Cyber Essentials Plus audit, after a new website or remote-access change, or because a customer, insurer or board has asked for independent assurance.
Targets, timing, accounts and what is out of bounds are written down before any testing starts.
Findings include what was tested, how it was exploited and a screenshot or request where that helps your team reproduce it.
An executive summary for leadership and a technical section your IT provider can actually work from.
Fixes are prioritised by impact and effort, so a small team is not handed a flat list of hundreds of items.
After you have patched, we can retest the closed issues and confirm they stay closed.
A Leicester-based team that can mobilise quickly and explain the results in plain English.
Internet-facing websites, firewalls, VPNs, email and remote access. This is what an attacker sees before they have a foothold.
Testing from inside the network, as if a laptop or user account was already compromised. Useful for seeing how far an attacker could move.
Login, payments, customer portals and APIs, looking for issues such as broken access control, injection and weak session handling.
A review of Wi-Fi configuration, guest separation and whether an attacker near your office could join the network.
We confirm the business reason, the assets, the test window and any systems that must not be touched.
We map what is actually exposed, including forgotten hosts and services.
Automated checks plus manual exploitation of issues that matter. We stay inside the agreed scope.
You get a clear report and, if useful, a short briefing for the people who will fix the issues.
A penetration test answers “what could an attacker do, right now, if they tried?” Vulnerability management answers “what weaknesses exist, and are we closing them every month?” Many organisations use both. A test is a point in time. Scanning is how you keep up after the test is finished. If you are preparing for Cyber Essentials Plus, a test is not a substitute for the scheme’s own audit, but it often finds the issues that would fail one.
Most East Midlands clients combine more than one of these. Start with the gap that matters most.
Ongoing discovery and prioritisation between tests.
Full details →Certification after you have closed the obvious gaps.
Full details →Help deciding what to test and how to brief your board.
Full details →A tightly scoped external test for a small business is often a few days of testing plus reporting. A web application or internal test takes longer. We confirm the window on the scoping call so it does not collide with a go-live or payroll run.
The work is designed not to. We agree rules of engagement, avoid destructive tests, and pause if something unexpected appears. You have a named contact during the window.
External tests often need none. Web and internal tests are more useful with a normal user account, so we can see what happens after login. We never ask you to share passwords in email.
No. Plus includes its own technical audit against the scheme controls. A penetration test goes further on the systems you choose and is useful evidence for customers, but it does not by itself award certification.
Yes. Most of our East Midlands clients already have an IT company. We write the report so they can remediate, and we will join a call to explain the findings.