Frequently Asked Questions

Absolutely. All our testing is conducted with proper authorization and within agreed boundaries. Before any testing begins, we establish a legally binding agreement that outlines the scope, methodology, and limitations of the assessment. This agreement provides us with the legal authorization to conduct testing activities. Without such authorization, attempting to breach a system would indeed be illegal. We operate within all relevant UK and international laws.

Protecting your data is our top priority. We maintain strict confidentiality for all information encountered during testing. Our team follows a comprehensive data handling policy that includes: not extracting sensitive data unless explicitly authorized, documenting only the minimum necessary to demonstrate vulnerabilities, securely storing all testing data, and permanently deleting all client data after the engagement concludes. Our team members sign NDAs and are bound by strict ethical guidelines.

Yes, we carry comprehensive professional indemnity and cyber liability insurance. While our testing methodology is designed to be non-destructive and minimize any risk of disruption, we maintain insurance coverage to protect both our clients and our business in the unlikely event that something unexpected occurs. We're happy to provide proof of insurance upon request.

Many compliance frameworks require regular security testing. Our challenge and services can help satisfy requirements for standards such as ISO 27001, Cyber Essentials Plus, GDPR, and PCI DSS. We provide detailed documentation that can be used as evidence during audits. Additionally, our team can help interpret compliance requirements and develop strategies to address any gaps identified during testing.

We use a comprehensive range of ethical hacking techniques similar to those used by malicious actors. These may include network scanning, vulnerability assessment, web application testing, API security analysis, social engineering (if agreed upon), password cracking, and exploitation of found vulnerabilities. Our methodology follows industry standards such as the OWASP Testing Guide and NIST guidelines. All techniques are agreed upon in advance and conducted within the defined scope.

Our testing is designed to minimize disruption to your business operations. We employ non-destructive testing methods and can schedule intensive testing during off-hours if needed. We also maintain constant communication channels during testing, so you can request us to pause if any issues arise. In our experience, most testing proceeds without any noticeable impact on day-to-day operations.

Absolutely not. Our testing is ethical and non-destructive. We never delete, modify, or exfiltrate your data unless explicitly authorized to do so as part of the testing scope. If we need to demonstrate a vulnerability that might involve accessing sensitive data, we will always seek explicit permission first and will only access the minimum necessary to prove the vulnerability exists. Our goal is to help improve your security, not compromise it further.

The duration of testing depends on the size and complexity of your IT infrastructure. Typically, our challenge testing ranges from 1-4 weeks. We'll provide a specific timeframe estimate during the scoping phase based on the agreed scope of testing. This includes initial reconnaissance, active testing, and the preparation of detailed reports. We work efficiently to deliver results as quickly as possible without compromising the thoroughness of our assessment.

After the challenge, we provide a comprehensive report detailing our findings, regardless of the outcome. If we succeed in finding vulnerabilities, we'll explain each issue, its potential impact, and provide actionable recommendations for remediation. We'll also present options for ongoing security services if you'd like assistance in addressing the issues. If we fail to breach your security, we'll pay you £10,000 and can still provide insights into areas where your security is particularly strong.

If we fail to breach your security within the agreed timeframe, we will process the £10,000 payment within 30 business days of the conclusion of the challenge. The payment method will be specified in the challenge agreement, typically via bank transfer. We proudly stand by our commitment and have never failed to honor a payout.

Our £10,000 challenge is the most visible difference, but our approach is unique in several ways. We focus on real-world security testing rather than checkbox compliance. Our team consists of ethical hackers with extensive experience in offensive security. We provide actionable reports written in plain English that explain both technical details and business impact. Most importantly, we're outcomes-focused: our success is measured by how effectively we help you improve your security posture, not by how many vulnerabilities we find.

Absolutely. While the challenge itself includes detailed recommendations for remediation, we offer additional services to help implement those fixes. Our team can provide hands-on assistance with vulnerability remediation, security architecture improvements, policy development, and staff training. We also offer ongoing managed security services to help maintain your improved security posture over time. Our goal is to be a long-term security partner, not just a one-time testing provider.