What is the difference between Type I and Type II?

Type I attests that controls are designed appropriately at a point in time, a snapshot. Type II attests they operate effectively across an observation period (6 or 12 months). Enterprise buyers strongly prefer Type II; Type I is mostly useful as an interim credential while observation period evidence accumulates.

Which Trust Service Criteria should we include?

Security is mandatory. Availability is essential for any service organisation where uptime matters to customers. Confidentiality is common where customer data is sensitive. Processing Integrity applies to systems that calculate financial or other critical outputs. Privacy is added where PII is processed. We recommend the right scope during initial scoping.

How long is the observation period?

Minimum is 3 months; typical is 6 or 12 months. Enterprise buyers strongly prefer 12-month Type II reports as they cover full annual cycles. We typically recommend 6 months for first audit, transitioning to 12-month cycles thereafter, but the right choice depends on your sales context.

Do we need Vanta, Drata or another compliance platform?

No. If you already use Drata, Vanta, Secureframe or similar, we work with it and configure it to produce audit-grade evidence. If you don't, we run the evidence process without a platform, so you avoid an extra annual subscription. A tool can cut manual evidence work, but it is never a requirement to get through your SOC 2.

How does SOC 2 compare to ISO 27001?

SOC 2 is a US-originating attestation framework strongest in North American markets; ISO 27001 is the international ISMS standard with broader global recognition. Many organisations need both. The good news: controls overlap 70%+, so a well-designed compliance programme produces evidence usable for either.

How much does SOC 2 cost?

Cost depends on Type I vs Type II, the Trust Service Criteria in scope, system complexity and integrations, and how mature your evidence already is. We work to a fixed fee agreed up front, so there are no surprise invoices, and we give you that quote after a short scoping call. The CPA attestation is billed separately and independently.

Home › Services › Penetration Testing Services

Find the Weaknesses Before an Attacker Does

Manual, intelligence-led penetration testing from CREST-accredited, senior consultants. We test your applications, APIs, network and cloud the way a real attacker would, then hand you a clear, prioritised report you can act on.

Get penetration testing scope + fixed quote Talk to a testing specialist

CREST-accredited Senior testers Fixed-fee delivery Free retest included

Get your penetration test scope + fixed quote

Tell us what you need tested and we will come back within one business day with scope, timeline and a fixed fee.

CREST-accredited consultancy Senior testers, no junior handoffs Fixed-fee, scope-bound Prioritised, actionable report Free remediation retest

Where testing falls short

Why most penetration tests disappoint

A weak test gives false comfort. These are the gaps that let real issues slip through, and what our testing does differently.

Scan dressed up as a test

An automated scan relabelled as a penetration test, missing the business-logic and chained attacks that actually cause breaches.

Surface-only coverage

Testing the login page but never the API behind it, where authorisation and access-control flaws really live.

Unreadable reports

A raw tool dump with no severity, no proof and no remediation steps, so nothing gets fixed.

No exploit chaining

Findings listed in isolation, missing the chain of low-risk issues that combine into a critical compromise.

Junior or offshore delivery

Sold by seniors, delivered by juniors, with no real depth when it matters.

No retest

Issues reported but never verified as fixed, so you cannot prove remediation to customers or auditors.

What we deliver

What you get from a RedSecLabs test

A test run by senior, CREST-accredited consultants, and a report both your board and your engineers can use.

Scoping workshop to agree targets, depth and rules of engagement.

Manual, intelligence-led testing across web, API, network, mobile and cloud.

Business-logic and auth testing the flaws scanners cannot find.

Exploit chaining to show real-world impact, not just isolated bugs.

Severity-rated findings each with evidence and business impact.

Clear remediation guidance specific steps your engineers can follow.

Executive and technical report written for both audiences.

Free remediation retest to verify and evidence that fixes hold.

How we work

Our penetration testing process

A senior tester leads you from scope to a verified, evidenced result.

Scope

We agree targets, depth and rules of engagement with you.

Recon

We map the attack surface the way an adversary would.

Test

We manually test and exploit, chaining issues for real impact.

Report

We deliver severity-rated findings with evidence and fixes.

Debrief

We walk your team through findings and remediation.

Retest

We re-test fixed issues and confirm they are closed.

Make the right choice

Commodity scan vs senior-led penetration test

	Commodity scan	RedSecLabs (CREST-accredited)
Method	Automated, templated	Manual, intelligence-led
Business logic	Missed	Tested in depth
API & authorisation	Often skipped	Core focus
Exploit chaining	Not done	Demonstrated end to end
Report	Raw tool output	Executive + technical, prioritised
Delivered by	Junior/offshore	Senior CREST testers
Retest	Extra cost	Included
Fees	Open-ended	Fixed, scope-bound

Questions

Penetration testing, answered

What types of penetration testing do you offer?

Web application, API, external and internal network, mobile, and cloud penetration testing, plus red team engagements. We scope the right mix for your risk and your obligations.

Are your testers CREST-accredited?

Yes. RedSecLabs is a CREST-accredited company and testing is delivered by senior, examined consultants, not juniors or offshore teams.

How is this different from a vulnerability scan?

A scan finds known issues automatically; a penetration test manually exploits weaknesses and chains them to prove real impact. We do the latter, and can run scanning as part of ongoing hygiene too.

Do you provide a retest?

Yes. A retest of remediated findings is included, so you can prove to customers and auditors that issues were not just found but fixed.

Will the report satisfy our customers or auditors?

Yes. You get an executive summary for stakeholders and a technical report with evidence and remediation, suitable for procurement, compliance and your engineering team.

How quickly can you start?

After a short scoping call we confirm scope and a fixed fee, then book the work. Tell us any deadline and we will be honest about what is achievable.

Related services

Ready to find your weaknesses first?

Tell us your scope and any deadline. You will get a scope recommendation and a fixed-fee quote, usually within one business day.

Get my penetration test plan Talk to a testing specialist