Service

Penetration
Testing

> nmap -sV --script=vuln target.co.uk_

We think like attackers so you don't have to. CREST-certified testers simulating real-world attack scenarios against your infrastructure, applications, and people.

Find the holes before they do.

A penetration test is a controlled, authorised simulation of a real cyber attack against your systems. Unlike vulnerability scanning — which is automated and shallow — penetration testing uses the same creativity, persistence, and lateral thinking that genuine threat actors employ.

The result? A clear, prioritised roadmap showing exactly where your defences fail and precisely how to fix them — before an attacker finds the same weaknesses for real.

Why Hedgehog?

Our testers come from the DEFCON trenches — CTF winners, bug bounty veterans, and red team operators. We combine attacker creativity with rigorous methodology and reporting that both your board and your engineers can act on immediately.


Comprehensive coverage.

Every organisation is different. We tailor the scope to your environment, your threat landscape, and your objectives — not a one-size-fits-all checklist.

External Infrastructure
Your internet-facing perimeter — firewalls, VPNs, mail servers, DNS, remote access portals. We probe every exposed service for misconfigurations, outdated software, default credentials, and chained vulnerabilities that automated scanners miss.
Internal Infrastructure
What happens once an attacker is inside? We simulate a compromised workstation or rogue insider, testing Active Directory, network segmentation, privilege escalation paths, and lateral movement opportunities across your internal estate.
Web Applications
Deep-dive testing of your web applications against the OWASP Top 10 and beyond. We go past automated scanning into manual testing of authentication, authorisation, session management, business logic flaws, and API security.
Mobile Applications
iOS and Android application testing covering local data storage, certificate pinning, API communication, reverse engineering resilience, and compliance with the OWASP Mobile Top 10.
Cloud Configuration
AWS, Azure, and GCP environments reviewed for misconfigurations, over-permissive IAM policies, exposed storage buckets, insecure serverless functions, and compliance with CIS Benchmarks.
Social Engineering
Phishing campaigns, vishing (voice), pretexting, and physical social engineering. Test your people — not just your technology. Includes awareness metrics and recommendations for training improvements.

How we work.

Our methodology is rooted in industry-standard frameworks, enhanced by real-world offensive experience. We don't just run tools — we think.

Frameworks & Standards
OWASP # Web & mobile application testing guide
PTES # Penetration Testing Execution Standard
OSSTMM # Open Source Security Testing Methodology
NIST SP 800-115 # Technical Guide to Information Security Testing
CREST # CREST Penetration Testing Guide
CIS # Centre for Internet Security Benchmarks (cloud)

Testing approaches

We offer three approaches depending on your objectives:

Approach What We Know Best For
Black Box Nothing. We start with only a target name or IP range — just like a real external attacker. Realistic simulation of an external threat. Good for testing detection and response capabilities.
Grey Box Partial information — typically user-level credentials, network diagrams, or application documentation. Most common approach. Balances realism with efficiency and maximises the vulnerabilities uncovered within a fixed timeframe.
White Box Full information — source code, architecture documentation, admin credentials, network topology. Maximum depth. Ideal for critical applications, compliance audits, or when you want the most thorough assessment possible.

From scoping to sleeping easy.

A straightforward, transparent process designed to give you maximum insight with minimum disruption.

Phase 1

Scoping & Discovery

We sit down with you — no charge — to understand your environment, your concerns, and your objectives. We define the scope, agree the rules of engagement, and set expectations. You receive a clear Statement of Work before anything begins.

Phase 2

Reconnaissance

Passive and active information gathering. We map your attack surface — open ports, exposed services, DNS records, leaked credentials, technology stacks, and anything else an attacker would find before launching their assault.

Phase 3

Exploitation & Testing

The main event. Our testers use the same tools, techniques, and lateral thinking as real threat actors — attempting to exploit every weakness found. We chain vulnerabilities together to demonstrate real business impact, not just theoretical risk.

Phase 4

Reporting & Debrief

You receive a comprehensive report with every finding rated by severity (CVSS), clear evidence (screenshots, proof-of-concept), and actionable remediation guidance. We walk you through it face-to-face — no jargon, no ambiguity.

Phase 5

Remediation & Retest

Fix the issues at your pace. When you're ready, we retest every finding — included in the price — to verify each vulnerability has been properly closed. You get a clean letter of assurance, in writing.


What you receive.

Every engagement delivers the same comprehensive output. No hidden extras, no surprise upsells.

Deliverable Detail
Executive summary A 2–3 page, jargon-free overview of risk posture, key findings, and strategic recommendations — designed for the board, not the SOC.
Technical report Every finding documented with CVSS score, attack narrative, evidence (screenshots, request/response captures), affected assets, and step-by-step remediation guidance.
Risk heat map Visual overview of findings by severity and asset, making it easy to prioritise remediation effort.
Remediation tracker A structured spreadsheet of all findings with severity, status, owner, and deadline columns — ready to drop into your project management workflow.
Face-to-face debrief A walkthrough session with your technical and leadership teams. We explain each finding, answer questions, and help prioritise remediation.
Free retest Once you've remediated, we retest every finding at no additional cost and issue an updated report confirming closure.
Letter of assurance A formal letter confirming the scope, dates, and outcome of the engagement — suitable for clients, auditors, and regulators.

Pen test FAQ.

It depends on scope. A focused web application test might take 3–5 days. A comprehensive external and internal infrastructure test for a mid-size organisation typically takes 5–10 days. We'll give you a clear timeline during scoping.

We go to great lengths to avoid disruption. Testing is planned around your schedule, and we maintain constant communication. Denial-of-service style testing is never performed without explicit written consent and is typically done out of hours.

A vulnerability scan is automated — it runs a tool, produces a list, and stops. A penetration test is manual and creative — a skilled human actively attempts to exploit weaknesses, chain findings together, and demonstrate real business impact. Think of it as the difference between a spell checker and a professional editor.

At minimum, annually — and after any significant infrastructure change, application release, or security incident. Many compliance frameworks (PCI DSS, ISO 27001, Cyber Essentials Plus) require regular testing. We'll help you determine the right cadence.

Yes. Our testers hold industry-recognised certifications including CREST CRT/CCT, OSCP, OSCE, and CHECK. The company is a CREST member and an IASME-accredited Cyber Essentials assessor. See our credentials page for full details.


Let's find your blind spots.

Every engagement starts with a free, no-obligation scoping call. Tell us what you're worried about and we'll tell you how we can help.