Find out how far an attacker could get, before one tries.

RyanSec runs penetration tests and red team engagements for companies that want an honest answer. You get a clear report, a walkthrough with your team, and a retest to confirm your fixes worked.

Book a scoping call What we test

A typical breach path — from one email to your most sensitive data

Phishing emailOne person opens a convincing invoice
LaptopA foothold on a single machine
Saved passwordsCredentials left in the browser
File serverAn admin password used everywhere
Domain adminControl of every account
Customer databaseThe thing you were worried about

Most breaches are a chain of small, ordinary weaknesses. We find the chain, show you every link, and tell you which one to break first.

What we test

Every engagement is hands-on. Automated scanners are a starting point, never the deliverable.

Web application testing

Login, sessions, access control and business logic, plus the OWASP Top 10 — the flaws that only surface when a person probes how your app is meant to work.

1–2 weeks

API testing

REST and GraphQL APIs, including token handling and whether one customer or role can reach another's data.

3–10 days

External network testing

Everything you expose to the internet: servers, VPNs, mail, remote access, and the subdomains nobody remembers setting up.

3–5 days

Internal network & Active Directory

We start from an ordinary employee laptop and find out how close we can get to domain admin and your most sensitive data.

1–2 weeks

Cloud security review

AWS, Azure and Google Cloud: identity and access, exposed storage, logging gaps, and paths from a low-privilege account to full control.

1–2 weeks

Red team engagement

An objective-led campaign against your people, processes and technology, to find out whether your team would notice and stop a real attack.

4–8 weeks

Penetration test, or red team?

If you're not sure which you need, start here. Most companies begin with a penetration test.

	Penetration test Find the weaknesses	Red team Test the response
The question it answers	Where are the weaknesses in this system?	Would we detect and stop a real attacker?
Scope	Named apps, networks or cloud accounts, tested thoroughly	A goal, such as reaching customer data, by any means you approve
Who knows it's happening	Your IT and security team	A small group of senior stakeholders
Typical length	1–3 weeks	4–8 weeks
Best when	You're launching, meeting a compliance requirement, or testing for the first time	You've fixed earlier findings and want to test detection and response

How an engagement works

Scoping call

A 30-minute call to agree what's in scope, what worries you most, and any constraints. No charge.

Proposal

A fixed quote, test dates, rules of engagement and named contacts. Nothing starts until written authorization is signed.

Testing

Regular check-ins while we work. Anything critical is reported the same day, not saved for the report.

Report & debrief

A summary for leadership, detailed findings for engineers, and a call to walk through both.

Retest

Once you've made fixes, we verify each finding and issue an updated report you can share with customers and auditors.

Ground rules on every engagement

Signed authorization from the system owner before any testing begins.
An emergency stop contact on both sides for the whole engagement.
Your data encrypted throughout, and deleted 30 days after the final report.

What you get at the end

Every report opens with a plain-language summary your leadership can read in ten minutes. Then each finding gets its own page: what we found, why it matters to your business, and exactly how to fix it.

Executive summary
Findings ranked by risk
Step-by-step fixes for your engineers
Debrief call with your team
Attestation letter for customers and auditors

Sample findingRS-2026-014

Same local administrator password on every workstation

Severity: High
Affected: All sampled workstations
Effort to fix: Low

What we found: The built-in administrator account uses the same password on every workstation we checked. Access to one laptop meant access to all of them.
Why it matters: One compromised laptop gives an attacker administrator rights across the fleet. This is how a single phishing email turns into a company-wide incident.
How to fix it: Deploy Windows LAPS through Group Policy or Intune so each machine gets a unique, automatically rotated password, then block network sign-in for local accounts.

Common questions

How much does an engagement cost?

Every engagement is quoted at a fixed price after the scoping call, based on what's in scope and how complex it is. If the scope changes, we agree the change in writing before doing any extra work.

Could testing disrupt our systems?

Testing is planned around your business. Anything with a risk of disruption, such as heavy automated scanning, only happens with your explicit approval and inside agreed windows. We can test a staging environment instead of production.

Will the report satisfy our auditors?

Reports are written to cover what auditors look for under standards such as PCI DSS, ISO 27001 and SOC 2. You can also request an attestation letter to share with customers.

Do you sign NDAs?

Yes, before scoping if you prefer. Findings are shared only with the contacts you name.

What do you need from us?

A clear scope, a technical contact, and test accounts or VPN access where relevant. A short checklist comes with the proposal.

How soon can you start?

Usually within two to three weeks of signing. If you have a hard deadline, mention it when you get in touch.

Tell us what you'd like tested.

Send a few lines about your company, what you want tested and when. You'll hear back within one business day to arrange a scoping call.

Email to book a scoping call

Or write directly to redteam@ryansec.com