Technical Security Review

This is our white-box audit, and where a penetration test is adversarial, the Review is collaborative. We expect full visibility - architecture diagrams, configurations, identity and access policies, network topology, source code where applicable, process documents, and discussion with staff. Much as a thorough vehicle inspection assesses roadworthiness by examining how something is built and maintained rather than by driving it into a wall, the Review examines the design and operation of your estate directly. We supplement this transparency with technical enumeration of your systems to discover aspects of them you may not know of at all. Unlike our Manual Penetration Test and Red Teaming engagements, the Review does not focus on realistically simulating attacker behaviour. Instead, it focuses on directly assessing the quality of your security architecture, configurations, processes, and operational practices.

Our Technical Security Review service begins with an assessment of your organisation's security based on full knowledge of your systems and processes, but we don't stop there. Our Technical Security Review also includes hands-on exploitation of security issues we identify - not to realistically simulate attacker behaviour, as our Red Teaming engagements would include, but rather to confirm and demonstrate the reality of attack vectors we find. This also enables us to assess their ease for an attacker as well as their impact for your organisation. A Technical Security Review thus remains an offensive security engagement and follows all the processes we use for such engagements.

We prioritise our security test for the threats your organisation most likely faces: what represents your most vulnerable attack surfaces, your most critical systems and data, and what attackers would find most valuable. This draws on the same skills we offer in more depth with our Threat Modelling service. That model focuses everything that follows, so our attention is spent where compromise would hurt most rather than spread thinly across findings that do not matter to your particular risk.

A Technical Security Review engagement can include surveying security across an entire organisation. This can include any of the following, and more:

• Identity management. Issues around identity, access, authentication, and trust are among the most common routes attackers use to gain footholds in real systems. Authentication mechanisms include passwords, session cookies, access tokens, and multi-factor authentication - all of which may be vulnerable.
• Updates and patch management. Out-of-date software frequently has public vulnerabilities any attacker can exploit.
• Staff behaviour. The best technical security in the world is meaningless if your staff simply invite attackers in. The security-consciousness of staff and their susceptibility to phishing is a first-class security concern.
• Cloud and SaaS configuration. Many of the most significant computer systems to your organisation are off-premises and managed by third parties. Cloud and software-as-a-service platforms with insecure configuration are a common vector for real-world attacks.
• Network architecture. Flat networks amplify security risks, as they facilitate escalation of a breach from a single foothold to a full compromise.
• Backup and recovery readiness. Attackers are often ultimately after your data. The configuration of your backups, and your ability to recover from an attack, are critical to your organisation's overall security.
• Logging and monitoring coverage. How quickly could you detect and respond to an attack? That may be the difference between a breach with limited impact and one disastrous for your organisation.
• Security processes and policies. Does your organisation have plans in place for responding to breaches? Staff training to provide security mindset? Rules and best-practices for how to use computer systems securely? What kind of gaps exist between what is written in policy and what happens in practice?
• Hardening against recognised baselines. Standards like Cyber Essentials Plus, ISO 27001, or the CIS Benchmarks represent a security baseline, not comprehensive protection - but if your organisation has invested in, or is considering pursuing, compliance with these standards, we will take that into account when assessing your system.

While we can draw on established methodologies and standards when appropriate, we aren't box-checkers and our approach is tailored to your organisation and to our best judgement of where real risks lie. We assess your systems, configurations, and behaviours directly through technical investigation and offensive testing rather than taking them on trust.

You receive a prioritised report mapping each finding to its business impact, rated by a consistent measure of likelihood against consequence so your remediation runs in priority order rather than alphabetically. Alongside it sits a clear roadmap: what to fix now, what to plan for, and what to monitor. The result is written to be acted on by your engineers, IT team, or external MSP, in coordination with executive or operations leadership.