Penetration testing · Vulnerability assessment
Find out how your network holds up, then keep it that way
We start with a deep penetration test of everything you run, from the firewall to Microsoft 365, and hand you a report ranked by real-world risk. Regular vulnerability checks then catch anything new before it becomes a problem.
Report ranked by real-world risk
Retest after your fixes
Yann Davies
Managing Director
·
Updated 12 October 2026
Price
Priced to your network, fixed before we start
Every network is different, so we price the test after a short scoping call. You get the quote in writing, and it does not change once testing starts. Prices exclude VAT.
What the test covers
Step one
Scoping call
We agree what is tested and when, and how we reach you if we find something serious.
Outside in
External test
Your website, email, VPN and anything else that can be reached from the internet.
Inside
Internal test
What someone could reach from a laptop or a visitor’s device inside your network.
Cloud
Microsoft 365 test
Sign-ins, MFA, admin accounts and sharing settings across your tenant.
The result
Report ranked by risk
Every finding in plain English, with what it means for you and how to fix it.
Proof
Retest after your fixes
Once you have fixed things, we test again so you have evidence it worked.
Priced after scoping
Fixed quote
in writing
The price depends on how many sites, devices and systems are in scope.
Scope
Agreed with you first
Report
Plain English, ranked by risk
Retest
After your fixes
Your IT provider
Stays as they are
Scoping calls are free and take 20 minutes.
The penetration test
A deep test of everything you run, explained in plain English
We agree the scope with you first, then test from the outside in: your website and email, your firewall and remote access, your internal network and your Microsoft 365 sign-ins. Every finding goes into a report ranked by real-world risk, with the fix written next to it. Once you have fixed things, we test again.
Afterwards
What a tested network lets you do
The report is where it starts. What matters is what you can do with it once the gaps are closed.
Send evidence when a customer or insurer asks
The report and retest show what was tested, what we found and that it was fixed.
Spend your budget on the right fixes first
Findings are ranked by real-world risk, so the most serious gaps get closed before anything else.
Go into Cyber Essentials Plus knowing where you stand
The test checks many of the same things the Plus assessor looks at, so you can fix gaps beforehand.
Get an independent check of your IT provider’s work
A second pair of eyes on your setup, written so your provider can act on it.
How the two fit together
Test once, then keep checking
1
First
Penetration test
A deep test of everything in scope, with a report ranked by risk.
2
Next
Fix and retest
We help you or your IT provider fix the findings, then test again.
3
Then
Vulnerability assessment
Scheduled scans every quarter or six months catch anything new early.
Book them together or one at a time. Both are quoted before we start.
Vulnerability assessment
Regular checks that catch what is new
A penetration test shows where you stand on the day. New weaknesses appear after that, whenever software changes or a new device joins the network. Our vulnerability assessment scans your systems on a schedule, every quarter or every six months, and tells you what needs fixing and how urgently. You can pay for it monthly.
★★★★★
Working within the healthcare sector, security, compliance and reliability are absolutely critical. ABCOM understood those requirements from day one. As cybersecurity and regulatory compliance became increasingly important, ABCOM helped us navigate those challenges with confidence.
Kay, Practice Manager, Family Dental, Crawley
A client of ABCOM for over 15 years
Free consultation call
Start with a scoping call
Tell us what you run and why you need a test. We will tell you what should be in scope and send you a fixed quote.
1
A short call
We go through your network, sites and systems in plain English.
2
An honest scope
We tell you what should be tested, and what can safely be left out.
3
A fixed quote
A written price for the test, with no obligation.
NCSC Assured Service Provider
Network and Microsoft 365 engineers
Reply within one working day
Or call 01444 871 200, Monday to Friday, 8am–6pm.
Book your free consultation call
20 minutes · No obligation · Fixed quote afterwards
FAQs
Your questions, answered
Answers from ABCOM, an NCSC Assured Service Provider.
What is the difference between a penetration test and a vulnerability assessment?
A penetration test is a deep, hands-on test where we try to get in and show how far we could go. A vulnerability assessment is a regular scan for known weaknesses. Most firms have a test first, then keep checking with regular assessments.
Will testing disrupt our work?
We agree timings with you at the scoping call, so you know what is being tested and when. Anything that could affect live systems is planned around you.
What do we get at the end?
A plain-English report listing what we found, ranked by risk, with practical steps to fix each item. When you have fixed things, we retest.
Does a penetration test mean we will pass Cyber Essentials Plus?
It helps you prepare and gives you useful evidence, but it cannot guarantee a pass. It does show you what to fix before the assessment.
How often should we have a vulnerability assessment?
Most firms choose every quarter or every six months. It is also worth adding a check after a big change, such as a new site or new remote access.
Do we need to change IT provider?
No. We work alongside whoever looks after your IT now, and the report is written so they can act on it.