Author
Founder & CEO, Pentesys
James Hinton is the founder of Pentesys, a CREST-approved UK company working only on offensive security: penetration testing, PTaaS, CTEM, external attack surface management and red teaming. He built the business around one discipline rather than a broad consultancy menu, and most of his time still goes on how engagements get scoped, delivered and reported. He writes here about the practical side of security testing and what buyers should be asking for.
LinkedIn profileA balanced, technically grounded comparison of AI-assisted and human-led penetration testing: what each does well, where AI fails, what CREST expects, and how to evaluate an AI-enabled testing provider.
Read articlePentesys has signed the CREST AI Charter, reinforcing our commitment to the responsible, transparent and professionally governed use of artificial intelligence in cybersecurity.
Read articleAn impartial buyer's guide to modern Penetration Testing as a Service platforms, comparing human testing models, portals, continuous testing, integrations and UK delivery.
Read articleIDOR flaws rarely show up in scanner output. How testers find broken object-level access control, and what actually fixes it in code.
Read articleReflected, stored and DOM-based XSS explained, with the output encoding, CSP and testing steps that keep it out of production.
Read articleParameterised queries stop most SQL injection. Where they get missed, how testers find what is left, and how to verify the fix holds.
Read articleWhat each OWASP Top 10 category means in practice, which ones testers find most often, and how to design them out.
Read articleThe vulnerability classes that keep turning up in web application tests, why scanners miss the important ones, and what to prioritise.
Read articleA successful security assessment doesn’t end when you receive a list of vulnerabilities; it concludes only when those risks are demonstrably closed….
Read articleHow findings get validated before they reach your team, why false positives cause friction with developers, and what to ask your tester.
Read articleSeverity ratings alone will not order your remediation queue. How to weigh exploitability, exposure and business impact after a test.
Read articleWhat a remediation plan needs to contain, how to assign owners and deadlines, and how to track findings through to verified closure.
Read articleFrom draft report to retest: the debrief, the remediation window, and the decisions that determine whether the test was worth commissioning.
Read articleCVSS, tester-assigned severity and business risk are three different things. How to read the ratings in your report without over-reacting.
Read articleWhat each section of a penetration test report is for, which parts matter to whom, and the details that reveal how the testing was done.
Read articleQuestionnaires only go so far. How to assess supplier security with evidence, and where independent testing fits into third-party assurance.
Read articleIndependent validation of a supplier's security controls: what it covers, how it differs from an audit, and when it is worth asking for.
Read articleHow to share testing evidence with customers and procurement teams without exposing exploitable detail. Summary letters and attestations.
Read articleHow to tell consultant-led testing from a rebranded scan: accreditation, methodology, reporting samples and the questions that expose the difference.
Read articleHow to explain to a board what a red team exercise buys that a penetration test does not, and how to set objectives worth paying for.
Read articleTurning a technical report into a board conversation: what directors need to decide, how to frame risk without a CVE list, and the questions that come back at you.
Read articleBuilding an internal case for testing spend using scope, risk and assurance obligations rather than fear.
Read articleRoles, user journeys, APIs and environments. The scoping decisions that decide whether a web application test finds anything worth having.
Read articleWhere an internal team adds value, where independence matters, and how most organisations end up running both.
Read articleTwo different models with different coverage guarantees. What each finds, what neither covers, and when running both makes sense.
Read articleWhat scanners are genuinely good at, the flaw classes they cannot reach, and how the two fit together in a testing programme.
Read articleHow much information to give a tester, what each approach costs you in coverage, and why grey box is usually the right answer.
Read articleReconnaissance through to reporting and retest, and what a tester is actually doing at each stage of an engagement.
Read articleA first-time buyer's walkthrough: scoping calls, rules of engagement, testing windows, findings as they land, and the report at the end.
Read articleSOC 2 does not name penetration testing as a control, but auditors commonly expect it. How testing supports the Trust Services Criteria.
Read articleWhat CREST assesses, what the individual certifications cover, and what accreditation does and does not guarantee about an engagement.
Read articleHow UK testing firms differ on delivery model, accreditation and reporting, and how to compare quotes that look similar on paper.
Read articleWhat technical due diligence covers during an acquisition, how much can realistically be done pre-completion, and what changes deal terms.
Read articleThe sections that matter in a testing proposal — scope, methodology, team, deliverables, retest terms — and the gaps that cause disputes later.
Read articleGetting scope right decides what a test can find. Asset inventory, environments, credentials, exclusions, and the mistakes that waste days.
Read articleA Cyber Essentials Plus assessment is a verification audit, not a penetration test. What each one covers, and why organisations often need both.
Read articleArticle 32 requires regular testing of security measures without naming a method. How penetration testing can help evidence that obligation.
Read articleIf you’re still treating your annual audit as a checkbox exercise, you’re likely missing the strategic shift toward continuous security validation….
Read articleISO 27001 does not mandate penetration testing by name. Where it supports Annex A controls, and what auditors typically want as evidence.
Read articleWhat a security assessment covers for a UK health or care provider, from clinical systems and patient data through to the evidence a DSPT submission needs.
Read articleAuthentication, transaction logic, third-party APIs and data handling: the areas that matter most when testing a financial application.
Read articleCheckout flows, payment integrations, discount logic and account takeover: where e-commerce platforms actually get broken.
Read articleWhat an internal assessment looks for once an attacker is already inside: credentials, lateral movement, and the path to domain admin.
Read articleDeciding what counts as your perimeter, handling cloud-hosted assets and third-party providers, and keeping the scope honest.
Read articleWhat if the lowest infrastructure penetration testing quote you receive is actually the most expensive mistake your security team makes this year?
Read articleiOS and Android testing beyond the app binary: local storage, certificate pinning, backend APIs and platform-specific weaknesses.
Read articleIdentity, managed identities, RBAC, storage exposure and network controls: how an Azure environment is assessed and where it usually leaks.
Read articleIAM, S3, roles and trust relationships, plus what AWS permits you to test. How cloud testing differs from a traditional infrastructure test.
Read articleShared responsibility in practice: what your provider secures, what remains yours to test, and how cloud engagements get scoped.
Read articleAuthorisation flaws, object-level access control and undocumented endpoints. Why API testing needs documentation and credentials to be useful.
Read articleCompany accreditation, individual certification, and the assumptions buyers get wrong about what a CREST logo guarantees.
Read articleWhat to expect from a vulnerability management platform, where scanner output stops being useful, and how validation changes the queue.
Read articleThe controls, evidence and testing work that sit behind an ISO 27001 certification, and the order most organisations tackle them in.
Read articleHow red teaming differs from penetration testing, what good objectives look like, and how detection and response get measured.
Read articlePhishing simulations are not the whole of social engineering testing. What these exercises assess, and how to run them without harming staff trust.
Read articleWhere AI systems introduce new exposure — data handling, prompt injection, integrations — and what to test before rolling them out.
Read articleWhat penetration testing is, the main engagement types, how testing is delivered, and where it fits alongside continuous assurance.
Read articleWhat CREST approval means for how an engagement is run, what evidence you can ask a provider for, and when it is worth insisting on.
Read articleRule hygiene, egress filtering, management interfaces and change control — the firewall issues that turn up repeatedly in testing.
Read articleObjectives, rules of engagement, initial access, and the detection conversation afterwards. What an adversary simulation actually involves.
Read articleThe questions that separate consultant-led testing from automated scanning, covering methodology, team, reporting and retest terms.
Read articleWhat drives the price of a penetration test, what a sensible scope looks like for a smaller organisation, and how to avoid paying for a scan.
Read articleWhy quotes for the same application vary so widely, what a day rate actually buys, and how to compare proposals on a like-for-like basis.
Read articleHow threat-led penetration testing works in practice: intelligence-driven scenarios, the frameworks that ask for it, and where it differs from a standard red team engagement.
Read articleMoving from annual testing to continuous coverage: what changes in scoping, delivery and reporting, and what it does not replace.
Read articleWhere special category data tends to leak — logs, exports, integrations, access control — and what to test when your systems hold it.
Read articleWhat organisations get from testing beyond a list of vulnerabilities: validated risk, evidence for customers, and a plan worth acting on.
Read articleThe five controls, the difference between self-assessment and the Plus audit, and what organisations typically fix before they apply.
Read articleCoverage versus objectives: what each engagement type is designed to answer, and which one your organisation actually needs.
Read articleCREST-registered testing delivered through a flexible PTaaS model — designed to fit your environment, risk profile and internal teams.
