Security

Most organisations think of cybersecurity as something defensive: firewalls, monitoring systems, security software, policies, and procedures intended to keep attackers out. Offensive security takes a different approach. Rather than asking whether a defence exists, offensive security asks whether that defence actually works.

Offensive Security

This is accomplished by deliberately examining systems from an attacker's perspective. By identifying weaknesses before real attackers do, organisations can understand where they are actually vulnerable, how those vulnerabilities could be exploited, and what improvements would most effectively reduce risk. While no security assessment can guarantee the absence of future breaches, offensive security can help organisations replace assumptions about their security with evidence.

There is no such thing as a perfectly secure system. Given enough motivation, time, and ingenuity, any defence can eventually be breached - which means the useful question is not whether your organisation can be attacked, but whether you understand how, where, and what it would cost you. Offensive security is the discipline of answering that question honestly: we attack your systems, with your permission and under careful rules, so that we find the gaps before someone who means you harm does.

Shellhex specialises in offensive security - as our tagline puts it, we break in before someone else does. We believe that understanding how systems fail is one of the most effective ways to improve how they are built, operated, and defended. Our offensive security engagements range from focused exploratory assessments through to realistic simulations of genuine attacks. Each offering answers a different question about your organisation's security.

Engagement Types

Our testing work falls into two families. Strategic Engagements assess your whole organisation, scaled by how deep and how adversarial you want us to go - the right place to begin if you want a complete picture. Targeted Assessments point that same offensive expertise at a single area of risk - the right choice when you already know where your concern lies, or when you want to add depth to one surface after a broader engagement. Our Targeted Assessment offerings cover multiple security domains: Digital Infrastructure, Human Processes, Physical and Wireless, Internal Compromise, Access Controls, and AI.

Beyond Compliance

Many organisations first encounter security testing through compliance frameworks, customer requirements, cyber insurance questionnaires, or procurement processes. Such requirements can provide useful motivation to improve security, but security testing is most valuable when treated as more than a compliance exercise. The objective of offensive security is not simply to obtain a report, satisfy a requirement, or tick a box. It is to obtain information about how your systems actually behave when subjected to scrutiny from an attacker's perspective. Our focus is therefore on identifying real risks, realistic attack paths, and practical improvements rather than merely measuring compliance against a predefined standard. There's no reason to feel embarrassed by any security weaknesses we find; admitting a system might not be secure is the first step to making it so.

Our Offensive Security Process

Offensive security may seem unfamiliar or even concerning to organisations unfamiliar with it, but in fact trust is foundational to offensive security engagements, and many large organisations contract offensive security tests regularly. Every engagement is conducted in accordance with the Computer Misuse Act 1990 and the UK GDPR, under a written contract, agreed Rules of Engagement, and NDAs where appropriate.

Before any Security Testing engagement contracts are even written, we'll schedule a meeting with your organisation where we can assess together what kind of testing makes the most sense for your organisation, and how to conduct it in a minimally disruptive way. From there, we will draft legal documentation. Scope is agreed in writing before anything begins - the exact IP ranges, application URLs, accounts, and exclusions, along with testing windows and delineated contacts inside your organisation in case something goes wrong. Within the boundaries you give us, we enumerate attack surfaces, identify weaknesses, and attempt to exploit them. We take care around anything fragile and avoiding destructive testing techniques unless you explicitly authorise them. We validate every finding by demonstration rather than inference, so you are never left guessing whether a theoretical issue is genuinely exploitable in your environment.

What You Receive

All our Security Testing services include as their deliverable a report aimed at guiding remediation of security weaknesses we find. Findings are prioritised according to their realistic impact on your organisation and accompanied by guidance intended to support remediation and future security improvements. We aim to communicate effectively with both technical and non-technical audiences. Security findings are only valuable if they lead to action, and our reports are designed to support decision-making by engineers, IT teams, operational leadership, and executive stakeholders alike. The objective is for our report's recommendations and insights to provide your organisation with a real improvement in operational capability and security posture.

Pricing

Due to the nature of our work and every engagement being unique, we cannot provide direct pricing for these services here. However, if you're curious about what we do and wonder if we're a good fit for your business, we're pleased to offer our Offensive Security Taster engagements for a fixed rate of £3,000 to £7,500 (exclusive of VAT). All of our prices are oriented around an intended base rate of £1,500 per day exclusive of VAT and expenses.

Strategic Engagements

Our Targeted Assessments focus on specific areas of your organisation's security, but security is inherently holistic, and real attacks frequently proceed by chaining multiple weaknesses together. A staff member clicks a phishing link. An account has excessive privileges. A network lacks segmentation. A monitoring alert is missed. None of these issues may be critical in isolation. Together, they become an attack. Strategic Engagements are how we test the security of your organisation's most fundamental aspect: how it works together as a whole. Rather than examining a single technology, department, or attack surface, they assess how different parts of an organisation reinforce one another - or fail to.

Our Strategic Engagement offerings are organised by increasing complexity, but are not simply sequential tiers; our offerings are designed to complement one another rather than compete with one another, and seek to answer different questions. While all have the potential to incorporate offensive security testing, they follow different methodologies and have different approaches. In particular, our Technical Security Review, Manual Penetration Test, and Red Teaming offerings are differentiated, among other things, based on information: a Technical Security Review operates with complete transparency into your systems, a Red Teaming engagement with no transparency at all, and a Manual Penetration Test in-between the two.

Where should we begin testing security?

A small, fixed-scope engagement intended to identify obvious issues and provide an initial understanding of your security posture.

Are our systems fundamentally sound?

A collaborative assessment of your architecture, configurations, processes, and operational practices intended to identify structural weaknesses that may not appear during attacker-focused testing, with demonstration of identified security flaws via offensive security testing.

How could this realistically be compromised?

A hands-on offensive security engagement focused on comprehensively identifying and demonstrating genuine attack paths through your systems.

Would we detect and respond to a real attack?

A realistic adversary simulation intended to test technical controls, operational processes, and organisational response under genuine pressure.

These services differ in scope and methodology, yet share a common objective: helping organisations understand how attackers might succeed and what can be done to make that success less likely.

If you are unsure which of these fits, that is itself something we resolve together in the consultation meeting that precedes any engagement - and for many organisations the Offensive Security Taster is the natural first step, precisely because it is the smallest. Where your concern is already narrow and specific rather than organisation-wide, our Targeted Assessments may suit you better than any of the engagements here.

Targeted Assessments

Our Strategic Engagements focus on testing your organisation's security in breadth, but given the reality of scarcity, for any given level of engagement complexity - and hence time and cost - there is a tradeoff between breadth and depth. A broad-but-shallow offensive security engagement is not necessarily the best option for organisations that already have potential weaknesses in mind, or when areas of focus are easy to identify. Our Targeted Assessments are aimed at exactly this situation: organisations that know roughly what they want to focus their security attention on, and go as in-depth as possible within that domain.

Many organisations may not have a clear sense of what aspects of their security are worth prioritising. In the same consultation meeting we have before any of our security testing engagements to guide the drafting of rules of engagement, we can recommend Targeted Assessments based on our judgement about your organisation's needs.

Our Targeted Assessments are organised into multiple categories, corresponding to different classes of security weakness.

Have you checked your systems foundations?

This represents the most direct attack surface: the websites your organisation operates, the servers and other digital systems you expose to the outside world, your internal networks, the security of your email.

You've tested your systems, but what about the people operating them?

The best technical security in the world is useless if your employees simply open the door to attackers. How vulnerable is your organisation to phishing? How much information can an attacker learn about your staff and operations just from public online sources?

What can attackers do on-premises rather than over the network?

Cybersecurity often assumes that attacks are coming from over the internet, but physical access to your systems represents an attack vector, and one far harder to defend against. Attacks on WiFi, Bluetooth, RFID and NFC, or radio networks; vulnerability to unauthorised office entry or break-ins, magnified by unencrypted drives on workplace devices; cyberattacks targeting security devices, smart office devices, industrial controllers, and embedded systems.

What happens when an attacker is already inside?

Security isn't just about building a perimeter. What happens when that perimeter gets breached... or if your threat model is someone already inside your organisation? How much damage could they do? What could an attacker actually do once they've obtained remote-code execution on one of your servers or workstations?

How do you stop attackers who enter through the front door?

The most common cyberattacks today don't rely on access through unauthorised channels; rather, they spoof the access credentials of legitimate authorised users of your systems, an attack vector many traditional defences such as firewalls are useless against. How do remote workers access your systems? How secure is your multi-factor authentication - if you use it at all - and what would happen if an employee's phone was snatched? How is access to third-party platforms like Microsoft 365 configured? What authentication methods do your own systems use - passwords, access tokens, cookies? How resilient are your passwords against modern cracking software?

Is your AI a door you have left unlocked?

Artificial intelligence introduces an entirely new attack surface, and one most organisations adopting it do not yet know how to defend. Can an attacker hijack your AI system with hidden instructions? What sensitive data could it be made to reveal? What actions could it be made to take on your behalf? As organisations adopt language models and AI agents, these become first-class security concerns.

These cover many different specific areas of security, and as a result, give insight into what kinds of attack surfaces Shellhex can explore even in our broader Strategic Engagements. Targeted Assessments are for those organisations who wish to assess the security of these areas individually.

Access Controls

The most common attacks today do not break in through some unguarded channel; they walk in through the front door, using the legitimate access of real users. Stolen credentials, hijacked sessions, and misconfigured identity systems defeat firewalls entirely, because to the system the attacker simply is an authorised user. Our Access assessments examine the security of that front door - how people and systems authenticate, and what happens when those credentials fall into the wrong hands.

How safely do your people connect from outside the office?

The security of remote and hybrid working - the access mechanisms, devices, and home environments through which staff reach your systems.

What happens if a staff member's phone is compromised or stolen?

The security of the mobile devices that increasingly hold the keys to everything else - and of any internal mobile applications your staff use.

How secure are the third-party platforms and identities you depend on?

The cloud services and identity systems you consume - where the most consequential modern misconfigurations live, and where a single compromised login can become control of everything.

How easily could an attacker steal and reuse credentials to your own systems?

The full range of credential attacks against the systems you build and run - and the session and token handling that decides how devastating a stolen credential becomes.

How would your passwords actually hold up against modern cracking?

A concrete demonstration, against your real password hashes, of how many would fall to a determined attacker and how quickly.

The distinction worth drawing within this category is between the systems you consume and the systems you build: the Cloud and Identity Assessment concerns the third-party platforms you can only configure, while the Credential Theft Assessment concerns the credentials to your own systems, which you can remediate directly.