Penetration Testing Newcastle upon Tyne

CREST-accredited penetration testing for organisations in Newcastle upon Tyne, scoped and delivered by the tester who writes the report.

Most testing in Newcastle is bought for a reason that has a date attached: a customer security review, a tender, an insurance renewal, or a board that has decided it would rather know. The reason shapes the test, and it is worth saying out loud at scoping rather than discovering halfway through that the report will not answer the question that prompted it.

What we test

Web applications and APIs, which is the bulk of the work for the city’s software companies. Internal and external infrastructure. Cloud platforms in Azure, AWS and Google Cloud, where the finding is more often a configuration than a vulnerability. Mobile applications. AI and LLM systems, where Solusec holds CREST accreditation specifically for AI-enabled testing. And device build reviews where the question is whether the standard laptop image would survive someone taking it home.

Talk to the tester →

Internal testing without the travel bill

External, web, API and cloud testing runs remotely. There is no technical reason for a tester to sit in your building to attack something exposed to the internet, and paying for one to do so buys reassurance rather than findings.

Internal network testing is the genuine exception, and Newcastle being a long way from Shropshire makes it a real question rather than a theoretical one. There are two honest answers. We travel, and quote the travel as a separate line on the quote so you can see exactly what it costs and decide whether it is worth it. Or we ship a preconfigured device that plugs into your network and connects back to us, which gives the same internal position for a fraction of the cost. For most internal tests the shipped device is the better buy, and we will tell you when it is not.

Testing for a customer security review

A growing share of Newcastle software companies buy their first test because an enterprise or public sector customer asked for one. That test has a job beyond finding vulnerabilities: it has to be legible to somebody in a procurement or risk team who will never speak to us.

That means the report needs an executive summary that a non-technical reader can act on, a clear statement of what was in scope and what was not, severity ratings that are defensible rather than inflated, and enough detail for your developers to reproduce and fix each finding. It also means a retest, because a report full of open findings answers the customer’s question in a way nobody wanted. We include a retest of remediated findings as standard rather than selling it back to you.

Engineering and operational networks

The subsea, marine and offshore engineering businesses along the Tyne run networks that do not look like office networks. Test rigs, project equipment, design systems and long-lived control hardware sit alongside the corporate estate and frequently on the same wiring.

Testing here is scoped around operations rather than through them. Anything that cannot safely be touched while it is running is agreed in advance, worked around, and stated plainly in the report as a limitation rather than quietly presented as coverage. In practice the most valuable first exercise on an engineering estate is not a test at all. It is establishing what is actually connected, because that answer is routinely a surprise and it determines what a test can usefully cover.

What you get

A report with findings ordered by what matters, each with evidence, business impact in plain terms and a remediation route. A debrief call with the tester, not an account manager. A retest of the findings you fix. And where you need it, a summary letter you can hand to a customer or insurer without exposing the technical detail.

You deal directly with the person doing the work throughout. There is no account layer between you and the tester, which matters most when something unexpected turns up mid-test and the sensible thing is a phone call rather than a ticket.

Lead times and scheduling

Typical lead time is two to three weeks from order, and we can sometimes move faster where a contract date demands it. If you are working to a deadline, say so at the first conversation. It is much easier to protect a date at scoping than to rescue one a fortnight later.

For organisations testing repeatedly across a release cycle we offer a retainer and a banked-days arrangement, where a block of days is bought up front and drawn down across projects. It is better value than quoting each test separately and considerably quicker to mobilise at short notice.

Penetration testing for Newcastle organisations

Solusec holds CREST accreditation at company level and the founder is CREST registered individually, which is independently verifiable on the CREST marketplace rather than being a claim on a website. CREST is widely specified in UK public sector procurement and by cyber insurance underwriters, which matters if your test has to satisfy somebody else.

We are not an NCSC CHECK provider and we do not hold SC clearance, so if a tender specifically requires either, we will tell you plainly rather than waste your time. Where it does not, CREST accreditation answers the question.