Compliance

No single law forces every UK business to run a penetration test, but card rules, customers, insurers and big changes often do. Here is how to decide.

What penetration testing for healthcare involves, whether NHS suppliers must do it, how to scope a test around clinical systems and what to do with the report.

ISO 27001 never uses the words “penetration test”, but Annex A 8.8 and 8.29 make one the evidence auditors expect. Here’s what that means in practice.

A self-check for whether your business meets the GDPR penetration testing requirements under Article 32, what the ICO actually expects, and how to fix the gaps before an audit does.

PTaaS trades the annual pen test for a rolling subscription. Here is a practical framework for deciding whether that trade actually suits your business.

The Trust Services Criteria never mention a pentest by name, yet auditors expect one for every SOC 2 report. Here is what actually drives that expectation.

Fixing what a pen test found is only half the job. Here’s how to prioritise remediation, and why retesting is what actually proves the fix worked.

From scoping to retesting, here’s where the time actually goes in a penetration test and why the total is longer than the days you’re quoted.

Penetration testing as a service and traditional pen testing solve different problems. A practical comparison to help UK businesses pick the right one.

A cyber security risk assessment ranks your threats by likelihood and impact so security spending goes where it matters most. Here is what it covers, who needs one, and how …