Frequently Asked Questions

A vulnerability assessment identifies and prioritises known weaknesses across your estate, largely through authenticated and unauthenticated scanning, validated by a consultant to remove false positives. It answers what is exposed.

A penetration test goes further: a consultant actively attempts to exploit weaknesses, chain them together, and demonstrate real business impact. It answers what an attacker could actually achieve.

Most organisations benefit from regular vulnerability assessment for coverage, and periodic penetration testing for depth. We will tell you honestly which one your situation calls for.

Cost is driven by scope and complexity rather than a fixed price list: the number of hosts, applications, user roles, and the depth of testing required. A small external infrastructure test is a very different exercise to a multi-role web application assessment.

We scope every engagement before quoting, so the figure you receive reflects the work actually required. There are no per-seat licences or tooling surcharges. Fees are set out in the Quote.

Tell us what you need scoped and we will come back with a written quote.

Scoping is typically a single conversation. Testing duration depends on the agreed scope. Reports are delivered after testing completes, following internal quality assurance.

Findings are not held back until the report: anything materially serious is escalated to you during testing, in line with the agreed escalation procedure, so you can begin remediating immediately.

Testing is performed using controlled techniques intended to minimise risk, strictly within the agreed scope and rules of engagement. As with any technical assessment, there is an inherent possibility of unintended system behaviour, and we are explicit about that rather than pretending otherwise.

We agree testing windows, escalation contacts, and any excluded techniques before work begins, and we ask that you maintain appropriate backups. Any material issue arising during testing is communicated immediately.

That depends on the assessment type. Typically we need an accurate list of in-scope targets, any credentials or test accounts required for authenticated testing, relevant documentation, and named points of contact.

We also need written confirmation that you have authority over the in-scope systems and that any third-party permissions, from hosting providers for example, have been obtained. This is what makes the testing lawful under the Computer Misuse Act 1990.

Nanorisk is a CREST accredited company for penetration testing. That is an assessment of the organisation itself, covering methodology, data handling, and quality assurance, not just individual qualifications. Engagements are delivered by experienced consultants holding recognised industry certifications from bodies including CREST, Offensive Security, and INE. All of our consultants are UK based, and all testing is carried out from the UK.

Nanorisk also holds Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance Level One and IASME Quality Principles, and is a Crown Commercial Service supplier. Every one of those credentials is independently verifiable. See our accreditations page.

Findings are rated on three factors together, rather than on an automated score alone: the technical impact should the issue be exploited, the likelihood of successful exploitation in your environment, and the CVSS v4.0 Base Score. Impact and likelihood are each rated High, Medium or Low.

CVSS v4.0 gives a repeatable 0.0 to 10.0 score: base metrics cover the inherent qualities of the vulnerability, threat metrics cover whether it is actively being exploited, and environmental metrics allow the score to be tailored to your infrastructure. Severity bands are Critical 9.0–10.0, High 7.0–8.9, Medium 4.0–6.9, Low 0.1–3.9, and Informational 0.0.

Every finding is also mapped to the Common Weakness Enumeration (CWE), and ratings are applied consistently across consultants and engagements, supported by our maintained findings library.

Every report contains an executive summary written for a non-technical audience, a technical summary covering scope, timeline and caveats, assessment findings with score cards and graphs, and the technical detail of each issue with supporting evidence.

You also receive an Open-Source Intelligence Gathering report on your organisation's public exposure at no additional cost, a threat intelligence report, confirmation of post-assessment clean-up, and appendices covering risk ratings, methodologies and tools used.

Alongside the report we provide an attestation letter suitable for sharing with your own clients, auditors or insurers. A spreadsheet export of your current findings can be generated at any point, during the assessment as well as after it, so remediation teams can start work without waiting for the final report.

Yes. Retesting of up to five findings of your choosing is included free of charge, for up to 60 days after the assessment, and so is a wash-up call to talk the findings through. You decide which five matter most.

Retest outcomes are issued as a separate retesting report through the Nanorisk Security Portal, so you have written evidence that a fix has been verified. You do not have to wait for the report either: where a finding is fixed while testing is still under way, you can mark it as client closed in the Portal and we will retest it during the assessment.

Retesting beyond the included five is chargeable, priced on the time required, and you will be told what that costs before any work is booked. The retest provision for your engagement is confirmed in the Statement of Works.

Reports and deliverables are provided for your internal use unless otherwise agreed. Nanorisk retains ownership of its methodologies, tools, and intellectual property.

Reports are delivered through the Nanorisk Security Portal, where findings are tracked individually with evidence, severity, and remediation guidance, rather than arriving as a static PDF attachment and nothing else.

Yes. Nanorisk treats all client information accessed or generated during engagements as confidential, and confidentiality obligations survive termination of the contract.

Client data is hosted within the UK and/or European Economic Area, protected by access controls, encryption, and audit logging. Full detail is in our Privacy Notice.

No. Nanorisk does not sell security products, raw automated tooling output, or certification services. We are an independent assessment consultancy, which means our findings carry no commercial incentive to recommend a particular vendor.

We do provide assessment and preparation support for organisations pursuing Cyber Essentials and Cyber Essentials Plus, but the certification itself is issued by the relevant certification body, not by us.

Get in touch with an outline of what you need assessed, even a rough one. We will follow up with the scoping questions that matter, then issue a written Quote and Statement of Work.

Once you accept, testing is scheduled around your operational constraints. You can send us the details here or call 0191 369 2434.