External and perimeter testing
Attacking what faces the internet from the outside, to find what actually holds.
Anyone with public IPs and a firewall nobody has ever tested.
They deliver alongside usSomeone should try to break it before somebody else does.
Fortifyroot handles the offensive side — testing systems by attacking them, in scope and with written permission. We bring them in when reviewing the design is no longer enough and something has to be tried for real.
A capability partner, not a product purchase. One scope and one invoice, with their specialists on the engagement.
What we work with
The products, and who each one suits.
6 listed
Web and API application testing
Manual testing of the application itself — authorisation, business logic, session handling — well past what a scanner reports.
Product teams shipping features faster than anyone reviews them.
Cloud and identity attack paths
Chasing the route from a low-privilege foothold to the role that owns the whole account.
Organisations whose cloud estate grew without a permissions model.
Internal network testing
Starting from inside — a contractor laptop, a spare port, a compromised seat — and seeing how far that gets.
Offices, factories and campuses running flat networks.
Social engineering and phishing simulation
Testing the people and the process alongside the systems, with the boundaries agreed in advance.
Organisations that want to know how staff respond before an attacker finds out.
Retesting after remediation
Going back to confirm the fixes closed the finding rather than moved it.
Anyone who has to show an auditor or a customer that the report was closed out.
What buying through us changes
A partnership is only worth what it changes.
Better than list
One scope, one contract, one invoice through us rather than a separate negotiation. Where the engagement carries tooling licences we place those and the price is better than list; the testing days are costed in the proposal so you can see what you are buying.
Named contacts
You know who is testing your systems and how to reach them during the window. Findings come with a person's name against them and working notes behind them, not a ticket number.
Startup credits
There are no credits against testing days. Where an early-stage company qualifies for a vendor programme on tooling that is in scope, we sponsor that application; the award is the vendor's call.
How we help
The work around the product.
- Work out what is worth testing, and say plainly when a test is premature and the money is better spent elsewhere.
- Write the scope and the rules of engagement — targets, windows, what is out of bounds, who to ring if something breaks.
- Get the authorisations in place, including from your cloud provider and hosting partner where that is required.
- Stand by through the test window so anything that wobbles in production is handled by people who know the system.
- Do the remediation — we fix what the report finds, in your code, your configuration and your identity model.
- Book the retest and close the findings out in writing for your auditor or your customer.
Where this is not the answer
A penetration test is a snapshot of one scope on a set of dates. It is not assurance that you are secure, and it replaces none of patching, backups, logging or an identity model — if those are missing, a test will hand you an expensive list of things you already suspected, and we will tell you to fix the basics first. Fortifyroot tests; the fixing is ours and yours. And we do not certify anyone: where a customer wants an attestation, that signature belongs to an auditor, not to the people who did the testing.
Next step
Buying Fortifyroot? Talk to us first.
Tell us what you are trying to do and we will come back with the sizing, the licensing and the price — from a partner, within two working days.