What you receive
A findings report, fix guidance, a debrief and a retest under the engagement terms.
For UK businesses and MSPsPenetration testing services
Penetration testing services
Investigate what an attacker could really do.
Fig tests applications, APIs and networks through authorised investigation of security weaknesses. You receive a findings report, practical fix guidance, a debrief and a retest under the engagement terms.
At a glance
Your engagement at a glance
Your team’s part
Your technical team prepares representative access and implements remediation.
Follow-up arrangements
The statement of work defines the retest scope, window and reporting arrangements.
A clearly defined scope. A penetration test is a point-in-time assessment of an agreed scope. It cannot guarantee that every weakness has been found or replace ongoing security management.
For investigating exploitable weaknesses in running systems. Public-footprint research can help identify which assets merit a separate testing scope. Explore public exposure checks.
Start with a scope discussion
We’ll agree a written proposal and obtain authorisation before the assessment begins.
The scope
What do Fig penetration testing services cover?
Penetration testing, also called a pen test or pentest, is an authorised assessment in which a tester investigates and attempts to exploit weaknesses within agreed boundaries. It helps explain the impact of vulnerabilities, rather than simply listing potential issues.
Web applications
Investigate access permissions and sensitive workflows in the application your customers or staff use.
APIs
Examine the endpoints, authentication and permission checks protecting data and operations.
Networks
Investigate reachable services and access boundaries on the networks and systems selected for testing.
Assessment detail
What do web, API and network penetration tests examine?
Choose testing around the business function you need to protect. A customer portal, its API and the network hosting it have different boundaries; including one does not automatically include all three.
| Testing area | Example focus | Business question |
|---|---|---|
| Web applications | Sign-in, user roles and sensitive workflows in a running application. | Can someone view another customer’s information or perform an action their role should not permit? |
| APIs | Endpoints, authentication, permissions and the way requests affect data or business functions. | Do the API’s own checks protect data and operations independently of the website or app interface? |
| Networks | External testing examines nominated internet-facing services. Internal testing starts from an agreed network position and examines reachable services and boundaries. | Can the tested access paths reach systems or network segments they should not? Network position, user access and permitted techniques define the conclusions. |
Before testing, identify a contact for urgent findings and agree the notification channel, timing and escalation route. This lets your team decide how to respond to a serious issue during the engagement, rather than relying solely on the final report.
When to book
When to book penetration testing
Before a significant release
Assess a new application, API or material change before relying on it for critical business activity. Agree a representative environment and allow time to address findings.
When customers ask for assurance
Provide evidence of a scoped test and the action taken afterwards. Confirm the customer’s required scope and any tester accreditation requirements before booking.
When a scan is not enough
Investigate whether weaknesses can be exploited within the agreed scope. Use the findings to focus engineering effort on the risks that matter to your business.
Security benefits
Security benefits of penetration testing
Investigate access boundaries
Test whether the agreed user roles and permissions behave as intended. A customer account should not gain access to another customer’s information simply because an application accepts a different request. Include the relevant roles and workflows in scope.
Understand the impact of weaknesses
Controlled testing can help distinguish a potential issue from an exploitable weakness. Evidence of what was possible helps your team assess the affected data, privileges and business functions without assuming every finding carries the same risk.
Check reported fixes
A retest examines the original findings after your team has made changes. Keep the retest result with the original report so there is a clear record of what was resolved, what remains and what was outside the follow-up scope.
Commercial value
The commercial value for your organisation
Support release decisions
Give product owners evidence for deciding whether a release needs further work. Use reported issues to plan engineering work before customers depend on a new function.
Answer procurement questions clearly
Customers may ask which application was tested, when it was tested and whether important findings were fixed. An appropriate report summary and retest record can make those conversations more specific. Confirm any required tester qualifications before commissioning.
Direct engineering effort
Use evidence and business impact to agree priorities between developers, security staff and management. Record why urgent fixes take priority and which lower-priority changes belong in a planned release.
How it works
Your penetration testing engagement
Scope and authorise
Confirm targets, user roles, testing depth, exclusions, dates and written permission. Identify escalation contacts and any third-party restrictions.
Prepare access
Agree the information and credentials provided to the tester. Check that the environment and test accounts reflect the workflows you need assessed.
Test and investigate
The tester examines the agreed systems and attempts controlled exploitation within the rules of engagement. Operational constraints remain part of the test boundaries.
Report and prioritise
Review the findings, supporting evidence and fix guidance. Consider business impact alongside technical severity when assigning owners and deadlines.
Remediate and retest
Your team implements the changes. Fig retests reported findings under the agreed terms and records the results; new features or additional scope require separate agreement.
Work is authorised in writing before any assessment begins, and stays within the agreed scope.
Compare approaches
Penetration testing, scanning or source code review?
Related services answer different questions. Confirm which scope you are buying before you compare quotes.
| Approach | What it tells you | Scope to confirm |
|---|---|---|
| Penetration testing | Investigates behaviour and exploitable weaknesses in a running application, API or network. | Agree targets, roles, permitted techniques and the access provided. |
| Vulnerability scanning | Automated identification of known weaknesses across agreed targets. | Useful for repeatable coverage; it may miss business logic and complex access-control issues. |
| Code security review | Examines the implementation in an agreed source code version. | Useful for code-level causes; it does not establish the security of the deployed environment. |
Illustrative example, not a client case study
A customer role can access another customer’s record
- Scope
- Two authorised test accounts representing different customers in a staging portal.
- Evidence
- A request by test customer A returns a record belonging to test customer B. Retain the relevant request, response and role context using agreed test data.
- Business implication
- The tested permission boundary does not separate customer records as intended. The management summary explains the affected business function; the technical detail supports reproduction and repair.
- Fix owner
- The application team corrects the server-side permission check and checks equivalent workflows.
- Retest record
- Record resolved, unresolved or unable to verify for the original finding, with the tested version and reason. These are illustrative labels; the engagement defines the actual retest format and window.
This is a teaching example of a finding record, not an extract from a customer report or a promise of a particular report template.
Cost and preparation
What affects the scope and cost?
Targets, application complexity, API coverage, user roles, access model and testing depth determine the quote. A small application with several permission levels may need more investigation than its page count suggests. Confirm reporting, debrief and retest terms in the statement of work.
What to prepare for your enquiry
Prepare a target inventory, architecture overview, role list, test accounts and permitted testing windows. Tell us about third-party hosting restrictions, sensitive workflows and the evidence a customer expects. Agree an escalation contact and a representative test environment.
Plan the engagement around your deadline
Allow for access preparation, the assessment, report delivery and your team’s remediation work. Confirm the delivery format, dates and any follow-up checks in your quote so each team knows when its input is needed.
Questions
Penetration testing questions
Practical answers about scope, cost and what happens next.
Compare all six security servicesWhat is penetration testing?
Penetration testing, also called a pen test or pentest, is an authorised assessment in which a tester investigates and attempts to exploit weaknesses within agreed boundaries. It helps explain the impact of vulnerabilities, rather than simply listing potential issues.
Link to this answerWill testing disrupt our systems?
We agree testing windows, permitted techniques, exclusions and escalation contacts before work starts. Testing can carry operational risk; any restrictions and precautions must be recorded in the rules of engagement.
Link to this answerWhat do white-box, grey-box and black-box mean?
White-box testing uses extensive information and access, such as documentation or source code where agreed. Grey-box testing uses partial knowledge or access. Black-box testing starts with limited information. These labels do not define coverage by themselves: the statement of work does.
Link to this answerHow often should we arrange a penetration test?
Choose a schedule based on system risk, significant changes and customer or contractual requirements. A previous test does not cover later releases automatically. Agree any specific standard or assurance requirement before booking.
Link to this answerHow long does a penetration test take?
Duration depends on the targets, complexity, user roles, testing depth and available access. We confirm timing during scoping; allow additional time for preparation, remediation and retesting.
Link to this answerCan you test APIs as well as websites?
Yes. Fig penetration testing can cover agreed applications, APIs and networks. API scope should identify endpoints, authentication methods, user roles and important workflows. An API is not assumed to be covered simply because the associated website is in scope.
Link to this answerShould we test production or a staging environment?
Agree the environment during scoping. A representative staging environment can support testing without exposing live customer workflows to the same operational risk, but differences from production limit the conclusions. Production testing requires explicit authorisation and agreed operational safeguards.
Link to this answerHow much does penetration testing cost?
Targets, application complexity, API coverage, user roles, access model and testing depth determine the quote. A small application with several permission levels may need more investigation than its page count suggests. Confirm reporting, debrief and retest terms in the statement of work.
Link to this answerDoes this service provide compliance certification?
No. Security testing and reviews can help identify gaps, but certification requires a separate assessment under the relevant scheme. Buying this service does not guarantee certification.
Link to this answerYour next step
Choose the support you need.
Explore a different assessment, manage remediation or prepare for certification.
Related service
Vulnerability scanning
Automated checks of agreed websites and systems for known weaknesses, helping you prioritise what needs attention.
ExploreRelated service
Code security reviews
Examine source code for weaknesses such as embedded secrets, unsafe input handling and missing access checks.
ExploreSoftware
The Fig platform
Manage compliance gaps, remediation and supporting evidence.
ExploreCertification
Cyber Essentials
Explore certification options for your organisation.
ExploreFurther reading
Further technical guidance
Independent sources that explain the methods and controls behind the review.
Independent guidance
NCSC: penetration testing
Explains the role of penetration testing in assurance and the importance of scoping.
Accountability
Working with Fig
Work with Fig directly or through your MSP. Your proposal identifies the contracting entity, assessment scope and delivery responsibilities.
The companies
Meet the companies behind Fig
See the entities, licences and people behind the platform and our assessments.
ExploreMSP partners
Security services for MSP partners
Offer these services under your own brand and retain the client relationship.
ExplorePublished evidence
Company details and published evidence
Verify our company details, licences and the claims we make in public.
ExploreContent updated .
Let’s agree the right scope.
Tell us what you need from penetration testing, the systems involved and any deadline. We’ll discuss the options and provide a quote.