Which type of test do you need first?
Start from the risk you are most worried about, not the full menu:
- Worried about the internet-facing edge? An external network test covers firewalls, VPNs and remote access portals: the doors an outside attacker tries first.
- Worried about a laptop taken over through phishing? An internal test starts from a compromised device and shows how far an attacker could move. An Active Directory review often belongs alongside it, because the paths to domain admin are what an attacker inside your network looks for.
- Running a portal, app or chatbot that handles customer data? Web, mobile or AI application testing goes deeper than a network test, into sign-in, access control and business logic.
- Relying on Microsoft 365, Azure or AWS? A Microsoft 365 security review checks sign-in controls, sharing and risky settings rather than attacking the platform itself.
- Already testing regularly and managing vulnerabilities well? A red team exercise tests whether you would detect and respond to a determined attacker.
Most engagements combine two or more of these. We follow OWASP testing methodology, including the Mobile Application Security Verification Standard (MASVS) for mobile apps, and can work to a different methodology or standard if your contract or regulator requires one.
Why isn’t a vulnerability scan enough on its own?
A scanner is fast and cheap to run often, which is why it sits at the heart of vulnerability management. What it can’t judge is context: three low-risk findings can combine into one serious breach, and only a person testing your environment will see the chain.
In practice the two work together. Scanning catches new issues between tests. A penetration test at set points shows whether your defences hold, and which scanner findings matter most.
For example, a test might find a forgotten test server, still reachable from the internet, holding a copy of customer records behind a default password. The fix would be to take it offline, remove the data and change the deployment process so test systems are far less likely to be exposed again.
Which findings need more than a one-off fix?
A report only reduces risk once the fixes are in place, so we explain what “fixed” looks like for each finding and check it again if you take up a retest.
Many findings point to ongoing work rather than a one-off fix: missing patches, weak admin controls or gaps in monitoring. That is where ASD Essentials uplift, vulnerability management and managed security take over. If your test covered a new website or app, our secure development team can fix the code directly.
