Frequently asked questions
Straight answers about penetration testing
Everything you need to know about how testing works, what it costs your team in time, and how we keep your systems safe while we do it.
What is a penetration test?
A penetration test is an authorised, controlled simulation of a cyber attack. Accredited testers look for weaknesses in your applications, infrastructure, cloud services or people, then safely prove which ones could genuinely be exploited and what the impact would be.
How is penetration testing different from vulnerability scanning?
Vulnerability scanning is automated and flags known weaknesses quickly and repeatedly. Penetration testing is carried out by skilled consultants who chain issues together, confirm real-world impact and find logic flaws that scanners cannot. The two work best together.
What is Penetration Testing as a Service (PTaaS)?
PTaaS replaces the once-a-year test with a 12-month programme that combines manual testing, managed scanning and attack surface monitoring. Results are delivered through a live platform rather than a static PDF, so you can track remediation as you go.
Who carries out the testing?
Testing is delivered in partnership with Rootshell Security, a CREST and CHECK accredited provider. Consultants hold recognised certifications including CREST, CHECK, Cyber Scheme and Offensive Security qualifications.
How often should we test?
As a baseline, most organisations should test at least once a year and after any significant change, such as a major release, new infrastructure or a cloud migration. Fast-changing environments benefit from continuous testing and scanning between engagements.
Will testing disrupt our systems?
Every engagement is planned with you in advance, including scope, timings, contacts and stop conditions. Testers work carefully to avoid disruption, and higher-risk activity can be scheduled outside business hours or run against non-production environments.
How long does a penetration test take?
It depends on scope. A typical web application test takes between three and ten working days from scoping to final report, while larger infrastructure or red team engagements run for longer. We will give you a clear timeline before work starts.
Can testing be done remotely?
Yes. External testing is remote by nature, and internal testing can be carried out remotely using a secure testing device installed on your network, so consultants can work as if they were on site.
What will we receive at the end?
You get clear, severity-ranked findings with step-by-step remediation advice, available in a live vulnerability management platform with exportable reports. A consultant can walk you through the results, and retesting confirms your fixes have worked.
Does penetration testing help with compliance?
Regular, documented testing supports frameworks and requirements such as ISO 27001, PCI DSS, Cyber Essentials Plus preparation and UK GDPR security obligations. Requirements vary by standard, so we will help you scope testing that produces the evidence you need.
How much does a penetration test cost?
Pricing depends on the size and complexity of what is being tested and whether you choose a one-off test or an annual programme. Get in touch for a tailored, no-obligation quote.
How do we get started?
Book a short scoping call. We will discuss your environment, objectives and any compliance drivers, then send a proposal with a recommended scope, timeline and price.
Still have questions?
Our team is happy to talk through your requirements, with no obligation.
Contact us
UK Pen Testing is a LevelUp Networks service delivering penetration testing and attack surface management for UK organisations, in partnership with CREST and CHECK accredited Rootshell Security.