An ethical hacker you can actually trust
We are a small, senior team of authorised ethical hackers. Because seniors do the work, you get real attack chains. Moreover, the ethical hacker who ran the test briefs you, so you never receive a scanner printout from a project manager.
Held to the standards serious buyers verify
Why trust decides who you hire as an ethical hacker
Handing an outsider access to your systems is an act of trust before it is a purchase. Therefore everything about how we work is built to earn it. In addition, every claim here is one you can verify.
Every ethical hacker is authorised
We test only systems you own or are explicitly authorised to test, because that is what keeps the work lawful. So there is a signed scope of work first, and no unauthorised access, ever.
Named senior ethical hackers
The person you speak with is also the person on your keyboard. Since there is no junior bench and no offshore hand-off, you know exactly who is testing. Moreover, you get the ethical hacker's name, certifications, and track record before you commit.
Your ethical hacker signs your NDA
We sign your NDA before any technical discussion. Furthermore, we never publish a client name without written permission, and we do not retain your findings after delivery. In short, discretion is the product.
What an ethical hacker actually does
A real engagement is a structured adversarial simulation, not a scan. Because depth matters, we follow the Penetration Testing Execution Standard. Moreover, every phase is manual-led where it counts.
Authorisation and rules of engagement
First we agree exactly which systems are in and out of scope. We also fix permitted methods, timing, and evidence handling. Since authorisation matters, the system owner signs it in writing before anyone touches a keyboard.
Map the real attack surface
We enumerate what an actual adversary would see: exposed services, forgotten subdomains, leaked credentials, and the human paths in. Most breaches start with something the asset owner forgot existed.
Chain the findings into real impact
A single open port is only noise. Therefore we prove the chain, showing how one weakness leads to the next. As a result you see real impact on your business, and every step is reproducible.
A written debrief from your ethical hacker
You get a redacted-quality report with risk context and remediation, written by the person who ran the test. Then a complimentary retest once you have fixed what we found.
Where our ethical hackers are engaged
Every engagement is scoped to your threat model, because we do not apply a generic playbook. In short, these are the mandates we take on most often.
Web & API penetration testing
Applications, authentication, and the APIs behind them, tested to OWASP depth against your real business logic.
Network & cloud assessment
Internal and external infrastructure, cloud configuration, and segmentation, that is, the paths a real intruder pivots through.
Red-team & adversary simulation
A full-scope, objective-driven simulation of a determined attacker, because people, process, and technology fail together.
Executive & private-client OPSEC
For founders, executives and high-net-worth individuals: personal footprint, home network, and device hardening against targeted attackers.
Enterprise-first, private clients by exception
Our institutional practice is our primary focus. We work with security teams inside large organisations, on retainer and on named engagements.
For private individuals such as founders, executives, and high-net-worth clients with a genuine threat model, we accept a small number of bespoke mandates each year. Because it matters, our most senior ethical hackers lead them directly. In short, it is the same enterprise-grade attention, opened to a handful of people who need it.
“Premium work at set rates. Where the budget changes, the scope changes.”
Every engagement is a fixed-fee project, priced after we understand your threat model. Since we do not bill hourly, the fee is never padded. Moreover, we reserve the right to decline work that does not fit our standards, so we take on only as many clients as our ethical hackers can fully attend to.
The work an ethical hacker should be judged on
Anyone can claim competence. Instead, we would rather show you a fragment of what we actually deliver. For example, here is a real finding, redacted, from an authorised engagement.
[+] foothold via exposed CI runner token
[+] lateral move → ████████ service account
[+] secrets pulled from ██████████ vault path
[+] domain admin obtained · t+47h
impact: full control of production identity plane
remediation: 3 changes, 0 downtime → verified on retest
A Fortune 500 retail client, in 48 hours
On a recent authorised red-team engagement, our ethical hackers reached domain admin within 48 hours. Because it was a chain, no scanner would have flagged it. They then handed over three fixes that closed it with zero downtime. Names stay confidential, since the method is what we are hired for.
Ethical hacker fees, scoped to your threat model
We quote a fixed fee after a written scoping brief, so there is no hourly billing and no surprises. Moreover, a full programme is not the only way to work with us, because the bounded review below is a genuinely different engagement rather than a cut-down one.
Where an ethical hacker starts small
from $4,500 Second doorThe External Exposure Review is a bounded review of what you expose to the internet. We map your public estate, test it, and verify every finding by hand rather than sending you a scanner export. Scope is fixed at up to five external hosts and one public web application. Your report then arrives within five business days.
Suited to
- An enterprise customer, an insurer or an investor has asked for evidence of testing, and you have a date to meet.
- Nothing external has ever been tested, so you first need to know what is actually reachable.
- You would rather see how we work on something small before committing to a full programme.
Not this engagement
- Internal network, Active Directory or cloud role review.
- Business logic testing, or work that reads your source code.
- Full exploitation chains against a defended estate.
- Auditor-grade evidence for SOC 2 or PCI, which needs the full engagement above.
The fee is credited in full. Commission a full engagement within ninety days of your report and the whole review fee comes off the price. Consequently the review costs you nothing if you go on to the deeper work.
This is a different engagement, not a smaller version of the one above. Moreover, it is priced by scope rather than by depth of care. Consequently, where the review finds something that needs the deeper work, we say so plainly and quote it separately.
Commitments we put in writing
These are the reassurances a buyer of sensitive work needs. Moreover, they are stated plainly here, because they should not be buried in the terms.
- NDA as standardSigned before any technical discussion. No exceptions.
- No retention of findingsYour data and results are deleted on project completion.
- Encrypted throughoutAll communication and deliverables move over encrypted channels.
- InsuredProfessional indemnity and cyber liability cover on every engagement.
- Background-checked staffEvery practitioner is vetted before they touch a client system.
- No subcontractingAll testing is done in-house, so there are no offshore juniors and no hand-offs.
Request a written scope
Tell us what you need to protect and what you are trying to prevent. A senior ethical hacker reviews every inquiry personally. We accept a limited number of engagements, so the more specific you are, the faster we can tell you whether we are the right firm. Everything runs in writing, which means you always hold a record of the scope, the price and the boundary.
A full engagement is fixed-fee from $25,000. The bounded External Exposure Review starts at $4,500 for organisations that need one clear answer rather than a whole programme. Tell us what you need, and we will point you at whichever fits.
We conduct authorised assessments only, on systems you own or are explicitly authorised to test. Therefore we do not access accounts that are not yours, surveil individuals, or recover third-party accounts. We will not respond to requests of that kind.
Questions about hiring an ethical hacker
Is hiring an ethical hacker legal?
Yes, when the work is authorised. A legitimate ethical hacker tests only systems the client owns or has explicit written permission to test. Because authorisation is the line, it separates lawful security testing from a computer-misuse offence, so we require it before any engagement begins.
What is your ethical hacker code of conduct?
We test only within an agreed, written scope; we never access accounts or data outside it; we report findings only to you; we retain nothing after delivery; and we decline any request that would involve unauthorised access, surveillance of individuals, or recovering accounts that are not the client's. It is non-negotiable, and it is what keeps both sides protected.
Can an individual hire an ethical hacker?
Our primary practice is institutional, but we accept a small number of private-client mandates each year for founders, executives and high-net-worth individuals with a real threat model. The engagement is led by a senior ethical hacker and priced the same way as our enterprise work.
How much does an ethical hacker cost?
There are two engagements. A full ethical hacker programme is fixed-fee from $25,000, and most land between $35,000 and $120,000 depending on scope. Alternatively, the bounded External Exposure Review starts at $4,500 and covers up to five external hosts and one web application. Both are quoted as one fixed number after a written scoping brief, therefore there is no hourly billing on either. Moreover, the review fee is credited in full against a full engagement commissioned within ninety days.
What does an ethical hacker deliver?
You receive a findings report with reproducible attack chains, business-risk context, and prioritised remediation. Moreover, the ethical hacker who ran the engagement writes your debrief personally. Then, once you have applied the fixes, a complimentary retest confirms them.
Guides
Guides to working with an ethical hacker
Each guide covers one question buyers ask, with scope and authorisation first.
- White hat hacker
- Hire an ethical hacker
- Ethical hacker cost
- Security hacker
- Microsoft 365 penetration testing
- Salesforce penetration testing
- Phishing penetration testing
- Dynamics 365 penetration testing
- ServiceNow penetration testing
- OSINT penetration testing
- Blue hat hacker
- Ethical hacker qualification