Sound familiar?
- A client security questionnaire asks when your last penetration test was
- Your cyber insurer wants evidence of testing
- You have a customer portal or web app holding personal data
- You got a pentest report full of findings and nobody to fix them
- Someone offered a "penetration test" that looks like an automated scan
Key facts
- dijitul does not hold CREST or CHECK accreditation and does not claim to
- We scope, arrange and coordinate accredited testers, then fix what they find
- NCSC says CHECK is for government, public sector and critical national infrastructure; other organisations do not need a CHECK provider
- CREST accredits testing companies and individuals in the wider market
- Common types: external infrastructure, internal network, web application and Microsoft 365 configuration
- Vulnerability scanning is a cheaper first step for many small businesses
- Coordination quoted upfront; remediation £45 an hour + VAT
Being clear about what we do
A penetration test is an authorised, simulated attack carried out by a skilled tester, who tries to exploit weaknesses rather than just list them. It should be done by people with recognised credentials and the right insurance. dijitul does not hold CREST or CHECK accreditation, and we do not carry out accredited penetration tests ourselves.
What we do is the part around the test that small businesses usually struggle with:
- Working out whether you need a penetration test at all, or whether vulnerability scanning or a security audit meets the requirement.
- Writing the scope: which IP addresses, websites, applications and accounts, and what is off limits.
- Finding and coordinating an accredited testing company, and acting as your technical contact.
- Preparing systems so the test is not wasted on things you already knew were broken.
- Fixing the findings and arranging a retest to prove they are closed.
CREST, CHECK and what to ask for
Two names come up most in the UK:
- CHECK is an NCSC scheme. The NCSC says it is for central government, public sector bodies and critical national infrastructure, and that organisations outside the public sector do not need to use a CHECK provider. If a public sector contract specifies CHECK, you need a firm on the NCSC's list.
- CREST is a not-for-profit body that accredits penetration testing companies and certifies individual testers. Many private sector clients and insurers ask for a CREST-accredited provider.
When we help you choose, we check the firm's current accreditation on the CREST or NCSC directory, the qualifications of the named testers, their insurance, and that the report will include a plain summary as well as technical detail.
Types of test a small business might need
| Test | What it covers | When it fits |
|---|---|---|
| External infrastructure | Your public IP addresses, firewall, VPN and remote access | You host anything on your own connection or use a VPN |
| Internal network | What an attacker could reach from inside, for example via a phished laptop | You have an office network with servers or shared storage |
| Web application | Log-ins, forms, account areas and APIs, typically against the OWASP Top 10 | You run a customer portal, booking system or bespoke app |
| Cloud configuration | Microsoft 365 or Google Workspace settings, sharing and admin roles | Most of your data lives in the cloud |
A brochure website on managed hosting rarely needs a full penetration test. Good website security and regular scanning are usually better value.
Before, during and after the test
- Authorisation: written permission and agreed rules of engagement. Testing without authorisation can be an offence under the Computer Misuse Act 1990, and hosting providers may need notice.
- Preparation: patch known issues first so the tester spends time finding what you do not know about.
- Test window: we are available during testing in case something needs pausing or a system misbehaves.
- Report: we go through the findings with you in plain English, ranked by risk.
- Remediation: we fix what is within our remit, such as patching, configuration and Microsoft 365 settings. Bespoke code issues go to your developer.
- Retest: the testing firm confirms fixes, so your evidence for clients and insurers is current.
What a useful report looks like
A good penetration test report has two parts: a short executive summary that a director can read in five minutes, and a technical section with each finding, how it was found, evidence, a risk rating and specific remediation steps. If a report is mostly scanner output pasted into a template, it was probably a vulnerability scan sold as a penetration test. We read the sample report before recommending a firm, so you know what you are paying for.
Cost
The testing firm's fee is paid to them and depends on scope and days of testing. Our scoping and coordination are quoted upfront, and remediation is £45 an hour + VAT. If you are not sure a full test is needed, start with an external vulnerability scan, which costs far less and often answers the question.
Frequently asked questions
Does dijitul do penetration testing?
dijitul does not carry out accredited penetration tests and does not hold CREST or CHECK accreditation. We scope the work, arrange and coordinate an accredited tester, prepare your systems, fix the findings and arrange the retest. For lighter needs, dijitul runs vulnerability scanning itself.
Do I need a CHECK or CREST penetration tester?
The NCSC says CHECK is for government, public sector and critical national infrastructure, so most private businesses do not need it unless a contract says so. Many clients and insurers ask for a CREST-accredited firm. dijitul checks what your contract or insurer actually requires before arranging a tester.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan is automated and lists known weaknesses such as missing patches. A penetration test is carried out by a skilled person who tries to exploit weaknesses and chain them together, showing real impact. Scans are cheaper and repeatable; penetration tests go deeper.
How often should a small business have a penetration test?
Many organisations test annually and after significant changes such as a new web application or network redesign. Smaller businesses without bespoke systems often get better value from regular vulnerability scanning plus an occasional test. dijitul can help you decide based on what clients and insurers ask for.
Can you fix the issues in our existing pentest report?
Yes. dijitul works through penetration test findings within our remit, such as missing patches, weak configuration, exposed services and Microsoft 365 settings, at £45 an hour + VAT. Issues in bespoke application code are passed to your developer with clear notes.
Related
Tell us what you need
We scope it, give you a clear fixed quote and do the work. No jargon.