CREST Accredited Penetration Testing

What you actually get

A penetration test is only as good as the person doing it. Automated scanning has its place, but it will not chain three low-severity issues into an account takeover, and it will not understand that your booking system lets one customer read another's records because the object reference is predictable. That takes a human who has done it before.

Every Solusec engagement is delivered personally by a CREST-qualified tester. There is no sales team translating your requirements badly, and no junior analyst running a scanner and reformatting the output. You speak to the person doing the work, before, during and after.

Scoping that doesn't waste your budget

We scope on a call, not through a 40-field web form. If your environment is smaller than you think, we will tell you and quote less. If a proposed scope leaves an obvious gap — an unauthenticated admin portal nobody mentioned, a forgotten staging environment on the same subnet — we will say so before you sign anything.

Testing

Work is carried out against a documented methodology aligned to CREST, OWASP and NCSC guidance. You get a named tester, an agreed testing window, and a direct channel for the duration. Critical findings are reported the moment we confirm them, not held back for the final report — if we find something that puts you at immediate risk, you hear about it that day.

Reporting

Two audiences, one document. An executive summary that a non-technical director can read and act on, and technical detail with full reproduction steps, evidence and remediation guidance that your developers or IT provider can work straight from. No 200-page scanner dump, no padding, no severity inflation to make the report look impressive.

Retesting

Fixing findings is the point. Retest of remediated issues is included as standard rather than sold as an extra, and you get an updated report reflecting the closed items — which is what your client, insurer or auditor actually wants to see.

Types of testing we deliver

Most organisations need a combination. We will help you work out which, and in what order, based on where your real exposure is rather than what is easiest to sell.

• Web application and API testing — authenticated and unauthenticated, business logic, access control, injection, session handling.
• Infrastructure and network testing — external perimeter and internal, including Active Directory attack paths.
• Cloud security assessment — AWS and Azure configuration, identity, privilege escalation paths.
• AI and LLM testing — prompt injection, data leakage, agent tool abuse, guardrail bypass.
• Mobile application testing — iOS and Android, including local storage and API interaction.
• Build and device reviews — laptop, server and workstation gold-image assessment.

Why CREST accreditation matters

CREST accredits the company, not just the individual. Our methodology, reporting standards, data handling, insurance and staff competence have all been independently audited against the CREST Penetration Testing Accreditation Standard.

In practice that matters in three places: public sector and enterprise procurement frameworks frequently mandate it; cyber insurance underwriters use it to judge whether an engagement was carried out to an acceptable standard; and if you ever have to demonstrate due diligence after an incident, "we used a CREST accredited provider" is a materially stronger position than "we used a consultant".

Common questions