Three fixed-price stages. Take one, two or all three.
Each stage is scoped and quoted on its own. Many firms start with the test to answer a specific question from an assessor, insurer or client, and decide about the rest once they've seen the report.
Vulnerability testing
A structured assessment of the routes an attacker would try first: what's reachable from the internet, what's exposed inside the office, and how your email, remote access and cloud accounts are configured. You get a ranked report and a call to go through it.
£1,000 fixed, quoted on the scoping call
What we look at
- External footprint: websites, mail, VPN and anything else facing the internet
- Internal network: servers, workstations, shared drives and printers
- Microsoft 365 or Google Workspace configuration and account security
- Email protection (SPF, DKIM, DMARC) and phishing exposure
- Remote access, backups and patch status
What you get
- Findings ranked by real-world risk, not raw scanner output
- Plain-English summary for partners and a technical appendix for IT
- A walkthrough call to agree what matters and what to fix first
- A report you can hand to an assessor, insurer or client
Remediation
Most testers hand over a PDF and leave. We fix what we found. Work is scheduled around the firm's hours, coordinated with your existing IT provider, and every fix is re-tested before we call it closed.
£2,500 fixed, quoted once we know what was found
What we do
- Patch, harden and reconfigure the systems flagged in the report
- Tighten account security: multi-factor sign-in, admin rights, password policy
- Fix email authentication and mail-filtering gaps
- Work directly with your IT provider on anything they manage
What you get
- Re-test of every finding, with before-and-after evidence
- Signed-off closure report
- Evidence pack shaped for Cyber Essentials, insurers and client questionnaires
- A fixed price that reflects what was actually found
Ongoing monitoring
Vulnerabilities come back as software updates, staff join and leave, and new services get switched on. Monitoring keeps the firm at the standard the test brought it to, without a long contract.
£1,000 a month, no long contract
What's included
- Regular re-scans of your external and internal estate
- Alerts when a new critical vulnerability affects software you run
- Checks that fixes stay fixed after updates and changes
- A named contact when something happens
What you get
- A monthly summary you can forward to insurers or clients
- Current evidence ready for your next renewal or questionnaire
- Month-to-month terms: keep it while it's useful, stop when it isn't
From first call to a closed report, with nothing technical asked of you.
You don't need an in-house IT team. Point us at whoever looks after your systems, tell us what prompted the call, and we take it from there.
Scoping call
A short call to understand your firm, your systems and what's driving the test. You get the fixed price for stage one at the end of it.
Testing
We run the vulnerability assessment on agreed dates, in a way that doesn't interrupt your staff or your clients.
Report and walkthrough
You get the report and a call to go through it. What's serious, what isn't, and what we'd fix first, in language a managing partner can act on.
Fix, re-test, evidence
If you want the findings fixed, we quote stage two and do the work. Every fix is re-tested and you get the evidence pack for whoever asked.
Stay protected, optionally
Monitoring runs month to month. Keep it while it's useful and stop when it isn't.
Next renewal, already ready
When Cyber Essentials, your insurer or a client asks again, the evidence is current and the answer is yes.