Penetration testing
Find the weak spots before an attacker does
A specialist team attacks your own systems, with your permission, to find weaknesses first. You get a clear report, a certificate and help with the fixes.
Who it is for
Who this is for.
Businesses that need to show their systems have been tested.
A client or insurer asks for evidence
A security questionnaire asks when you last tested. The answer is waiting on a test you have not done yet.
Your last report is out of date
An annual test shows one day. Since then you have released changes, and nobody is sure which findings were fixed.
Aiming for SMB1001 Diamond
Control 1.11.0.0 at the top tier needs an annual external test plus a social engineering assessment.
What changes
From not knowing to a clear record.
First
We scope what is tested and agree the rules, then you receive a fixed quote.
Then
Blacklock tests your systems. Findings are confirmed as they are found, so fixing can start early.
Ongoing
Your reports and certificate are kept as evidence, fixes are tracked and the retest is verified.
How it works
How it works.
We scope it with youWhat is in, what is out, and when.How this works underneath
Scope is set before a price is quoted. We agree the rules of engagement and the windows for anything intrusive. Destructive testing is out of scope unless you ask for it in an isolated environment.Blacklock carries out the testingSpecialists, named openly, not white-labelled.How this works underneath
Testing is carried out by Blacklock Security using CREST-certified consultants and its own testing platform. CyberGrape scopes the engagement, holds the commercial relationship and manages the work after the report. Your IT provider or developers do the fixing.Findings become tracked fixesNothing gets lost in a PDF.How this works underneath
Findings go into the Action Hub with owners and dates. The reports and certificate are kept as . For SMB1001 control 1.11.0.0 the social engineering side is covered separately through awareness training.
A small example
What this can look like.
- Situation
- A large client's questionnaire asks for a recent external penetration test.
- What changes
- The firm scopes its web application and agrees dates. Blacklock tests it.
- What happens next
- Findings go to the Action Hub. The developers fix them and the fixes are retested.
- What the firm hands over
- The executive report and the certificate.
This is an invented example to show how the service works. The names and figures are not a real customer's.
What you get
What you get.
An executive report
A short, plain-language summary for owners and clients.
A developer report
What to fix, in terms a developer can act on.
A full technical report
The complete record of what was tested and found.
A test certificate
What procurement teams and insurers often ask for.
Help with the follow-up
We track fixes through the platform and arrange the retest.
AI feature testing
AI applications, agents and integrations can be tested as well.
Price
How it is priced.
Testing is priced on the size and complexity of what is tested, so it is scoped before it is quoted. A scoping conversation ends with a fixed price and a clear statement of what is in and out of scope.
CyberGrape recognition.
- Winner, New Zealand Reseller News Innovation Awards 2023
- Finalist, ARN Innovation Awards 2026
Questions
Common questions.
A controlled, authorised attack on your own systems, carried out by specialists to find weaknesses before a real attacker does. Unlike an automated scan, it includes manual work, where a tester chains small weaknesses together to see how far they lead.
Only half of it. Control 1.11.0.0 needs an annual external penetration and vulnerability test, and an assessment of your workforce against social engineering. Both need evidence. We cover the technical test with Blacklock and the people side through awareness training.
ISO 27001:2022 does not name penetration testing in the Annex A control text, but the ISO 27002 guidance for A.8.8 and A.8.29 points at it, and auditors expect testing of significant systems at least annually, with findings tracked to closure.
At least once a year, and after a significant change to your systems.
No. Testing is scoped and scheduled in advance, with agreed rules and windows for anything intrusive.
Blacklock Security, our testing partner, using CREST-certified consultants. CyberGrape scopes the work, holds the commercial relationship and manages what follows the report.
No. We test, report and prioritise. Your IT provider or developers fix, and we can manage the handover and check the fixes.
Other services
Also available.
Find out what a test would need to cover.
Start with the free readiness assessment. It shows you where you stand, and we will tell you which service, if any, makes sense.