Penetration Testing Services — Web, Mobile, API, Cloud & Network
A penetration test is an authorised, simulated attack on your systems by people who think like attackers. Automated scanners list possible weaknesses; a skilled tester proves which ones can actually be chained into a breach of your data, payments or operations — and shows you how to fix them in priority order.
Mutex Systems runs manual, methodology-driven tests aligned to OWASP ASVS and MASVS, PTES and MITRE ATT&CK, for organisations in the UK, Europe, the GCC and Pakistan — where the same work is often called VAPT (vulnerability assessment and penetration testing) and is required by SBP and PTA rules.
1,831
attacks reported to the UK NCSC in the last year
9,663
ransomware leak-site victims in 2026 to 11 Nov (+32%)
13 Oct
actively exploited VPN flaw disclosed — edge devices remain the front door
Why it matters now
Based on incidents and figures in our UK & Europe threat report.
- October 2026 retail breaches started in customer-facing web and e-commerce systems — the exact scope of a web application test.
- Edge devices (VPNs, remote access) keep being exploited within days of disclosure; external infrastructure tests catch them before attackers do.
- Regulators increasingly ask for proof of testing: PCI DSS requirement 11, ISO 27001 control 8.8, SBP annual VAPT and PTA CTDISR all expect it.
What we deliver
Web Application Penetration Testing
Authentication, session handling, access control, injection, business-logic abuse and payment flows — tested against OWASP ASVS Level 2/3.
Learn moreMobile App Penetration Testing
iOS and Android apps tested against OWASP MASVS: local storage, certificate pinning, reverse engineering and the APIs behind the app.
API Penetration Testing
REST and GraphQL APIs tested for broken object-level authorisation, mass assignment, rate limiting and data exposure (OWASP API Top 10).
Cloud Penetration Testing
AWS, Azure and GCP: identity misconfiguration, privilege escalation paths, exposed storage and secrets, with cloud-provider rules of engagement.
External & Internal Network Testing
Internet-facing perimeter, VPN and remote access, then internal Active Directory attack paths from an assumed-breach position.
Red Team & Adversary Simulation
Goal-based, TIBER-EU and CBEST-style engagements mapped to MITRE ATT&CK that test detection and response, not just prevention.
Learn moreLLM & AI Application Testing
Prompt injection, insecure output handling and excessive agency in AI features, aligned to the OWASP LLM Top 10.
Learn moreOT-Adjacent Exposure Assessment
Discovery of internet-exposed controllers, HMIs and building systems — the root cause of the 2026 refrigeration attacks — with safe, non-intrusive techniques.
Penetration Testing as a Service (PTaaS)
Continuous testing on a subscription: retests on every release, findings streamed into your ticketing and into grComply as evidence.
How an engagement runs
- 1
Scoping & Rules of Engagement
Agree targets, test windows, credentials, out-of-scope systems and emergency contacts. A fixed-scope proposal follows.
- 2
Reconnaissance & Threat Modelling
Map the attack surface and likely attacker goals so testing time is spent where the business risk is.
- 3
Manual Exploitation
Testers validate and chain vulnerabilities, proving impact safely and stopping at agreed limits.
- 4
Reporting & Debrief
Executive summary, CVSS-scored findings, evidence and step-by-step remediation, walked through with your team.
- 5
Free Retest
We retest fixed findings and issue an updated report suitable for auditors, insurers and customers.
What you receive
- Executive summary written for boards and non-technical buyers
- CVSS-scored technical findings with reproduction steps and evidence
- Prioritised remediation plan and retest report
- Mapping of findings to ISO 27001, PCI DSS, SOC 2 and local regulator controls
- Attestation letter for customers and auditors on request
Frameworks and regulations this supports
PCI DSS v4.0
Requirement 11.4 mandates internal and external penetration testing at least annually and after significant change.
ISO 27001:2022
Annex A 8.8 (technical vulnerability management) and 8.29 (security testing) are evidenced by testing.
Cyber Essentials Plus
CE+ includes hands-on technical verification; a pre-assessment test avoids a failed audit.
SBP Cybersecurity Guidelines
Banks and DFIs in Pakistan need annual VAPT.
PTA CTDISR-2025
Telecom licensees need third-party security assessments.
DORA
EU financial entities need resilience testing, including threat-led penetration testing for significant firms.
grComply
Pen-test findings that stay visible until they are fixed
grComply, our GRC platform, imports penetration-test findings, links each one to the controls it affects across every framework you hold, and tracks remediation owners and due dates — so the next audit sees closed findings, not a PDF in someone’s inbox.
Explore grComply- Findings mapped automatically to ISO 27001, PCI DSS, SOC 2, CTDISR and SBP controls
- Remediation tasks with owners, due dates and retest status
- Continuous scanning between tests to catch new exposure
- Evidence pack generated for auditors and customers
Frequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated and lists potential weaknesses. A penetration test is performed by skilled testers who confirm which weaknesses are exploitable, chain them together as a real attacker would, and show the business impact. Scans are useful continuously; penetration tests give assurance at a point in time and are what most regulators and customers ask for.
How often should a small business run a penetration test?
At least once a year and after any significant change, such as a new application, a major release or an infrastructure migration. PCI DSS sets the same minimum. Businesses that release frequently benefit from penetration testing as a service, which retests on each release.
How much does a penetration test cost in the UK?
Cost depends on scope — the number of applications, APIs, user roles, IP addresses and cloud accounts — and on testing depth. A focused web application test is typically a few days of testing; a full red team engagement takes weeks. We give a fixed price after a short scoping call.
What is VAPT and is it the same as penetration testing?
VAPT stands for vulnerability assessment and penetration testing. It is the term commonly used in Pakistan, India and the Gulf, and in regulations such as the SBP Cybersecurity Guidelines. It combines broad vulnerability scanning with targeted manual penetration testing — the same service we deliver in the UK.
What are the stages of a network penetration test?
Scoping and rules of engagement, reconnaissance, vulnerability discovery, exploitation, post-exploitation (privilege escalation and lateral movement within agreed limits), reporting, and retesting after fixes.
Will penetration testing disrupt our live systems?
Testing is planned to avoid disruption: we agree test windows, exclude fragile systems, avoid denial-of-service techniques unless explicitly requested, and keep an emergency contact open throughout.
Do you test in Pakistan and the GCC as well as the UK?
Yes. Our teams in London and Karachi test for organisations across the UK, Europe, the GCC and Pakistan, and map findings to local requirements such as SBP, PTA CTDISR, SAMA and NCA.
Get a fixed-price penetration test proposal
Tell us what you need tested and when. We reply within one working day, or call our London office on 020 3307 5299.