RootCut

Not sure? Book a call

Request a test

What would you like us to test?

Pick the area you're worried about. Not sure? Use “Help me choose”.

A few clicks, about 3 minutes, with a rough estimate in man-days. We reply within one business day to scope it with you and set up your portal account.

Red team Adversary simulation against agreed objectives We attack your organisation the way a real adversary would, combining technical, physical and human techniques to reach agreed objectives, and measure what your team detects, blocks and misses along the way. External Internet-facing hosts and domains We look at your organisation the way an attacker on the Internet does: every exposed host, service and domain in scope is mapped, probed and checked for weaknesses, and every finding is verified by hand before it reaches your report. Internal Internal network and hosts We test what an attacker could do once inside: from a single foothold on your network we look for weak services, missing patches, insecure Active Directory settings and paths to your most critical systems. Phishing Email phishing campaign Realistic email campaigns, agreed with you in advance, that show how your people respond to phishing and where awareness training will have the most effect. Web application One web application We test one web application in depth, from authentication and session handling to access control, injection and business logic, using the OWASP Web Security Testing Guide as our baseline. Mobile application Android and iOS apps, plus their API We test your Android and iOS apps the way an attacker with the app on their own phone would: data stored on the device, traffic to your servers, authentication and the API behind the app.

Not technical, or no time for questions? Skip them and talk to one of our testers

What worries you most?

Pick the one closest to what keeps you up at night. We match it to the right test; you can still change it.

Hackers on the Internet Someone breaking in through your public IPs, VPN, mail or websites. Your website or app Customers' data leaking, or users seeing what they shouldn't. Someone already inside A hacked laptop or a rogue employee on your network. Your staff being tricked A convincing email that gets a password or a click. All of it, like a real attack A determined attacker using every way in. Bugs in code you write Flaws in your own software, before attackers find them.

Have you had a pentest before?

So we suggest a test that fits where you are now, not one that is too much or too little.

No, this is the first We start with the basics and explain everything in the report. Yes, once or twice We build on it: send the old report at the end if you like. Yes, regularly You are ready for deeper tests, such as a red team.

Is this for a requirement?

Helps us focus the test and the report on what your auditor, customer or board expects.

A customer or partner asked for it e.g. a tender, a contract or a security questionnaire asks for a recent pentest report. Certification ISO 27001, SOC 2, PCI DSS…: we make sure the report covers what your auditor expects. Your own initiative You want to know where you stand and what to fix first. After an incident We check that the hole is closed and look for similar ones.

We suggest

Based on your answers, best match first. Pick one to start; you can always ask us about the others.

What happens next

A few questions about what to test (about 3 minutes, with a rough estimate at the end).
We review your request within 1 business day and confirm the scope and price with you.
Nothing is booked or charged until you agree.