Penetration Testing Manchester

CREST-accredited penetration testing for Manchester businesses, delivered by the tester, not a call centre.

Penetration testing finds the security flaws in your systems that automated scanners and generic checks miss, before an attacker does. Manchester’s professional-services, digital, financial and creative businesses hold data and run systems worth protecting, and testing shows exactly where you are exposed.

What we test

Your external perimeter and internal networks, web applications and APIs, cloud, and even your AI and LLM systems. Everything is scoped around your business, tested by hand, and every finding is validated, so you get real risk, not scanner noise.

Book a free scoping call →

Why Manchester businesses choose Solusec

You deal directly with the tester, get a report your team can act on, and a free retest once you have fixed the issues. You deal directly with an accomplished ethical hacker with 25 years across IT and cyber security. Solusec is CREST-accredited, a Cyber Essentials and IASME Cyber Assurance Certification Body, and our track record is independently verifiable. No sales team, no jargon.

What actually happens, from the first call to the retest

If you have been told to get a penetration test and have never commissioned one, the useful question is not what the testing involves but what it asks of you. Durations below are indicative, and a contained scope moves faster.

Scoping call, around half an hour. What the system does, who uses it, how many kinds of user there are, and what you are trying to prove.
Written scope and fixed quote, usually within a day. What is in scope, what is excluded, and how many days the work takes.
Authorisation and rules of engagement, signed before anything begins. This is the document that makes the testing lawful. It names the systems, the dates, the contacts and what happens if something breaks. If you do not own the hosting, your provider may need to countersign, which is the step most likely to add a week.
Booking, typically two to three weeks from agreed scope. At short notice often within a week, and occasionally within a few days where the scope is small and self-contained.
Testing. Commonly a few days for a single application or an external perimeter, longer where there are several user roles or several different systems. Anything critical reaches you the moment it is confirmed rather than waiting for the report.
Report, within five working days of testing finishing. Prioritised, in plain English, with enough detail for a developer to reproduce each finding.
Fixes, on your timescale. Commonly the longest stage, and the one entirely in your hands.
Retest, included. We confirm the fixes worked and reissue the report, so you have a clean document for whoever asked.

Most slippage is waiting on the client, and it is nearly always the same short list: working credentials for every role, tested by you beforehand; written permission from any hosting or SaaS provider in scope, which can take longer to obtain than the test takes to run; confirmation of which domains and addresses are genuinely yours; and someone who can answer a question during the testing window without three approvals. Have that ready before you ask for a date. See urgent penetration testing if the deadline is already close.

What to test first when you cannot test everything

Few organisations can examine the whole estate at once, and those that try commonly spread the effort so thin that nothing is looked at properly. One system tested thoroughly is worth more than five skimmed. A workable order:

Anything reachable from the internet without logging in, because that is where an attacker with no relationship to you starts.
The authenticated parts of the product that hold other people's data, particularly anywhere one customer's account might reach another's. For a Manchester software, digital or media business whose product effectively is the company, this is usually the whole answer.
The identity layer: single sign-on, administrative accounts, multi-factor coverage, and what happens to access when somebody leaves.
Internal networks and end-user devices, which answer a different question: where a single compromised laptop leads.

Narrowing scope is not the same as quietly leaving things out. Whatever is excluded should be named in writing, so nobody reads the report a year later and assumes it covered ground it never touched. If your estate divides cleanly, testing the application this year and the network next is a sensible plan. Both are covered on our web application testing and network testing pages.

What makes a test larger or smaller

Effort follows how much the system actually does differently in each place, so two systems that look the same size from outside can differ by several days of work. For what that means commercially, see what a penetration test costs.

What pushes the effort in a penetration test up or down
Factor	Less effort	More effort
User roles	One or two that see much the same thing	Several, each to be tested against every other
Functionality	Repetitive screens over one data model	Payments, file handling and integrations, each behaving differently
Credentials	Accounts for every role ready on day one	Accounts arriving mid-test, or self-registration to work around
Knowledge given	Grey box, with an outline of the architecture	Black box, where reconnaissance consumes days first
Environment	Staging that genuinely matches production	Production only, confined to agreed hours
Internal testing	Remote access into the internal network	Work that genuinely requires physical presence on site

The black box choice is worth a moment of thought. Starting with nothing tells you what an outsider could discover unaided, a narrower question than most people mean to ask. Given credentials and an outline of how the system is built, the same days reach considerably further in.

How often to retest, and what a test will not tell you

Annually is the usual baseline, and it is what most customer questionnaires and insurers have in mind when they ask for a recent report. That cycle assumes nothing much changed. Bring testing forward when a release alters authentication, roles or permissions; when you start handling a category of data you did not handle before, such as payments or health information; when you move hosting or identity providers; when an acquisition adds an estate you did not build; or after a near miss.

The limits deserve the same clarity. A test describes a set of systems at a point in time, using the access and the days agreed. It does not certify that you are secure, it says nothing about what was excluded, and it will not tell you whether your monitoring would have noticed any of it unless detection and response were part of the brief. Nor is it a compliance certificate: if what you have been asked for is a baseline standard rather than a test, Cyber Essentials is the more direct answer. If you are still deciding who should do the work, our page on choosing a penetration testing company in Manchester covers what to ask.

Who we test for in Manchester

Manchester has 24,550 VAT or PAYE registered businesses, with 108,685 across Greater Manchester, on ONS UK Business Counts for 2026. Of the Greater Manchester total, about 98.5 per cent employ fewer than 250 people and roughly 88 per cent employ fewer than ten. Whatever impression the city’s skyline gives, this is overwhelmingly a market of small and medium organisations.

The concentrations that matter for testing are in the city itself. Manchester holds 1,510 legal and accounting businesses and 1,175 computer programming and consultancy businesses. On ONS employment figures for 2024 the city has around 22,000 people working in legal and accounting, 16,000 in financial services and 17,000 in software and IT consultancy. Greater Manchester has 4,390 software and IT consultancy businesses employing roughly 36,000 people.

Those are the two populations that buy most of the testing here, and they buy it for different reasons. Professional services organisations are asked by clients and regulators for evidence that client data is protected. Software companies are asked by their enterprise customers, usually as a condition of the contract and usually annually. Add eight NHS trusts across the Greater Manchester integrated care system, whose suppliers sit inside PPN 014 and the Data Security and Protection Toolkit, and you have most of the demand accounted for.

Three Manchester incidents, and what they have in common

The locally documented breaches of recent years make a point that is worth more than any statistic, which is that the system that fails is frequently not your own.

Greater Manchester Police, September 2023. GMP confirmed that a ransomware attack on a third-party supplier, one serving multiple UK organisations, had exposed information held on GMP employees. The force did not name the supplier. A police force is about as security-conscious a buyer as exists, and the exposure still came through a contract.

Greater Manchester councils, August 2024. An attack on Locata, a supplier running housing application websites, led to phishing emails being sent to users of housing services at Manchester, Salford and Bolton councils. Salford said at the time that the supplier was unable to confirm the extent to which personal data had been revealed. Three separate public bodies, one shared supplier.

Manchester Airports Group, August 2026. MAG confirmed a data security incident in which customer data was obtained by an unauthorised third party, affecting Manchester, London Stansted and East Midlands airports. Contact details, vehicle registrations and postcodes were involved; payment data was not. Reporting at the time put the number of customers affected at around 8.7 million, a figure MAG has not itself published, and the attribution circulated in coverage remains unconfirmed.

The University of Manchester makes a fourth, from June 2023, where the university stated that a small proportion of data relating to some students and alumni had been copied. Much larger figures circulated at the time; they came from the attackers rather than the university, which is a reason to be careful about what gets repeated.

If you supply any of these kinds of organisation, the practical consequence is the assurance you will be asked for. Buyers who have been through a supplier incident stop accepting a policy document and start asking for a certificate and a test report with a date on it.

Vulnerability assessment and penetration testing are different products

Worth separating clearly, because both are available in Greater Manchester at very different prices and the words get used as if they were interchangeable.

A vulnerability assessment is a tool run against your systems, producing a list of known issues matched against a database. It is fast, it is inexpensive, and the North West Cyber Resilience Centre offers versions of it delivered by supervised university students, which for a small organisation with nothing in place at all is a sensible first step and better than doing nothing.

A penetration test is a qualified person attempting to reach something they should not reach. The scan is where that person starts. What they add is the part no tool does: chaining two harmless-looking findings into one that matters, reasoning about what your application is for, and telling you which of thirty issues is the one that gets somebody into customer data.

Neither is a substitute for the other and the honest recommendation depends on where you are. If nobody has ever looked, a vulnerability assessment tells you the obvious things cheaply. If a customer contract or an ISO 27001 auditor requires an annual penetration test by an accredited third party, an automated assessment does not satisfy it, and submitting one as though it did tends to be noticed.

Talk to us about testing

Tell us what you need looked at and we will tell you what the work actually involves, what it costs and when we can do it. CREST accredited, and the testing is done by the person you speak to.

Common questions

Do you offer pen testing and pentests in Manchester?

Yes. Pen test, pentest and penetration testing all mean the same thing. We provide CREST-accredited penetration testing for Manchester businesses, including web application, network and infrastructure testing.

How much does penetration testing cost in Manchester?

It depends on scope, but we agree a fixed price up front after a short, free scoping call.

Do you work with Manchester businesses?

Yes. Work for Greater Manchester businesses is delivered primarily remotely, with onsite visits available and any travel quoted up front.

How do we get started?

Book a free call. We will tell you honestly what you need and what you do not, agree a fixed price, and move fast. No obligation.

How much of our own time will a penetration test take?

Less than most people expect. Budget around half an hour for the scoping call, an hour or so gathering credentials and confirming what is in scope, and somebody contactable during the testing window in case a question comes up. The part that takes real time is fixing what the report finds, and that happens afterwards on your own schedule.

Should we give the tester credentials, or is it more realistic without?

Give credentials in almost every case. Testing without them tells you what an anonymous outsider could find unaided, which is a narrower question than most organisations mean to ask. With accounts for each user role, the same number of days reaches much further into the application and finds the permission and data access flaws that matter most.

Can you test our live system, or do we need a staging environment?

Both are workable. Testing in production is common and we agree timing and any restrictions in advance, which occasionally adds a little time. Staging is preferable where one exists and genuinely matches live, because it removes those constraints. A staging copy that has drifted away from production is worse than testing production.

How often should we have a penetration test?

Annually is the normal cycle and is what most customer questionnaires and insurers assume. Test sooner if you change authentication or user permissions, start handling a new category of data, move hosting or identity provider, acquire systems you did not build, or have had a breach or a near miss.

Does passing a penetration test mean we are secure?

No, and any provider who says otherwise is overselling it. A test describes the systems in scope at one point in time, with the access and days agreed. It tells you what was found and what to fix. It says nothing about what was excluded, about changes you make next month, or about whether you would detect an attack in progress unless that was specifically in scope.

Our enterprise customer wants an annual test. Will a vulnerability scan satisfy that?

Usually not, and the contract wording will say. Where a requirement names penetration testing by an accredited third party, an automated vulnerability assessment does not meet it, however thorough the report looks. Where the requirement is for regular vulnerability scanning, it does. Send us the clause and we will tell you which one you are looking at rather than selling you the larger piece of work by default.

We were affected by a supplier breach, not our own. Does testing help?

It does not stop it happening, and anybody who tells you otherwise is selling something. What it changes is the position you are in afterwards. Organisations that have been through a supplier incident tighten what they ask of every other supplier, and those questions arrive as security questionnaires wanting certification and independent testing. Having the answers ready is the difference between keeping the account and starting a remediation project under somebody else’s deadline.

Do you work across Greater Manchester or just the city centre?

The whole of Greater Manchester, and the practical difference is small because most testing is remote. Where a site visit genuinely helps, for a scoping session or an internal test that is easier done in person, we travel. There is a separate page covering Greater Manchester more widely if your site is outside the city.

Penetration testing for Manchester organisations

Testing requirements in Manchester usually arrive through enterprise client security questionnaires, and investor or acquirer due diligence. Given the largest digital, software and professional services concentration outside London, alongside substantial manufacturing and logistics, the scope is most often a web application, an external infrastructure range, or both together where a customer has asked for evidence covering everything they can see.

The day count is driven mostly by how many user roles an application has and how much genuinely distinct functionality sits behind them, not by page count. We scope on a call rather than through a form, and the quote is fixed for the scope agreed. Manchester engagements usually run remotely, with an on-site day only where the estate needs it.

Where a Manchester requirement names CREST, check the provider holds accreditation at company level rather than relying on an individual certification: ours is verifiable on the CREST marketplace. See what a penetration test costs for ranges by test type.