Fifteen services in three groups, all run through the Aurian engagement lifecycle: scope, test, report, retest. Each page explains exactly what we test, how, and what you receive.
Offensive, 8 services
Manual testing of your perimeter, applications, cloud and people by senior consultants, reported so your own team can close every path.
Penetration testing servicesExternal penetration testing of your internet-facing perimeter: exposed services, VPN, mail and DNS, tested by hand by a senior consultant.
You receive Findings for every exposed service, each with evidence and a fix, and a debrief call on the priorities
Internal penetration testing from a foothold on your network: Active Directory attack paths, credential hygiene and segmentation, tested to domain admin.
You receive The attack path drawn out from foothold to domain admin, step by step, with a fix for each link
Web application penetration testing against the OWASP Testing Guide: authentication, access control, injection and business logic, tested by hand.
You receive Findings with evidence and reproduction steps, and a debrief with your development team
API penetration testing for REST, GraphQL and SOAP against the OWASP API Security Top 10: authorisation, rate limiting and undocumented endpoints.
You receive An inventory of every endpoint tested, undocumented ones included, with the request that reproduces each finding
Mobile application penetration testing for iOS and Android against OWASP MASVS: local storage, transport security, reverse engineering and the API.
You receive One report covering the app and the API it depends on, with evidence from the device
Wireless penetration testing of corporate and guest Wi-Fi: WPA2 and WPA3-Enterprise, rogue access points, guest isolation and signal leakage.
You receive A signal survey of where your networks reach beyond your walls, with findings ranked by risk
Cloud security assessment for AWS, Azure, Microsoft 365 and Google Cloud: CIS Benchmark review and attack-path testing of identity, exposure and logging.
You receive The identity attack paths drawn out, from ordinary account to tenancy control, mapped to the CIS Benchmark
Phishing simulation and social engineering assessment: measured, consented email and voice campaigns that show your awareness baseline and process gaps.
You receive Aggregate results, the reporting rate above all, and the process gaps behind them. Nothing that names individuals
Assurance, 3 services
Independent assessment against the Essential Eight, CIS Benchmarks and vendor guidance, with evidence gathered by testing rather than questionnaires.
Security assurance and compliance servicesEssential Eight assessment against the ASD maturity model: every strategy tested with evidence, rated ML0 to ML3, with a prioritised uplift roadmap.
You receive A maturity rating for each of the eight strategies, with the evidence behind it and a prioritised uplift roadmap
Security configuration review of firewalls, servers, endpoints, network devices and Microsoft 365 against CIS Benchmarks, with the exact settings to change.
You receive A finding for each deviation, ranked by risk, with the exact setting to change
Penetration test remediation support and retesting: hands-on help closing findings, sessions with your engineers or MSP, and a formal retest and report.
You receive A formal retest of the remediated findings and an updated report recording what has been closed
Managed, 4 services
Ongoing scanning and monitoring run by the same consultants who test, for organisations that need more than an annual engagement.
Managed security servicesManaged vulnerability management: continuous scanning of external and internal assets, results validated and ranked by a consultant, reported monthly.
You receive A monthly report ranked by exploitability, false positives already removed, and a standing point of contact
Continuous web application scanning between manual tests: authenticated scans with human review, drift detection between releases and monthly summaries.
You receive Consultant-reviewed findings after every release, with false positives removed and drift since the last scan
Managed SIEM monitoring: correlation and triage of events from network, endpoint, cloud and identity sources, with rule tuning and monthly reporting.
You receive Analyst-triaged alerts with context and a recommended action, mapped to MITRE ATT&CK
Managed EDR monitoring on your endpoint platform: alert triage, investigation, containment guidance, threat hunting and tuning by the consultants who test.
You receive Triaged, investigated alerts with a containment action, plus threat hunting across the fleet
Describe the system, the deadline and who is asking for the test. We will tell you which engagement fits and what it involves.