Lupine
US / UKRequest a quote
Home/Services
Offensive security services

Eight disciplines. One methodology.

Every engagement is manual, exploitation-led and run by a named tester you can talk to — at a fixed price agreed before we start.

Request a quote Claim a free finding
  • 8testing disciplines
  • 3–10days, typical engagement
  • Fixedprice, agreed up front
  • Freeretest within six months
Start here

Most people need less than they think.

Three honest starting points, depending on where you are. If none of them fit, a scoping call costs you nothing and we will tell you plainly if you need less.

01

This is our first test

Start with an external network test plus your primary web application. That pair covers the two routes an opportunistic attacker actually takes, and it is the cheapest way to learn where you really stand.

External network + Web application

See both scopes
02

We have an audit or a deadline

Scope follows the framework, not the other way round. Most commonly that means your web application and external perimeter, with segmentation validation added where PCI-DSS is in play.

Framework-led + Attestation letter

See framework mapping
03

Our programme is already mature

If you patch quickly and test regularly, another vulnerability list will not teach you much. Red team measures whether your detection and response actually work under realistic pressure.

Red team + Purple team replay

See red team scope
The catalogue

Every engagement we run.

Durations assume one target of moderate
complexity. We confirm effort at scoping.

Web application

When a customer-facing app handles accounts, payments or sensitive records.

  • Broken access control and privilege escalation between roles
  • Injection: SQL, NoSQL, command, template and deserialisation
  • Authentication, MFA bypass, session fixation and token handling
  • Business logic — pricing, workflow sequencing, race conditions
5–10 days OWASP ASVSWSTG Full scope

API

When mobile or partner integrations expose business logic directly.

  • Broken object and function level authorisation (BOLA / BFLA)
  • Mass assignment and excessive data exposure in responses
  • GraphQL introspection, batching abuse and query depth attacks
  • Rate limiting, resource consumption and enumeration resistance
4–8 days OWASP API Top 10 Full scope

Mobile application

When your iOS or Android app stores data or authenticates users on-device.

  • Insecure local storage, keychain and keystore misuse
  • Transport security, certificate pinning and pinning bypass
  • Runtime manipulation, hooking and anti-tamper effectiveness
  • The backend API the app depends on, tested alongside
5–8 days OWASP MASVSMASTG Full scope

AI and LLM

When you have shipped a model, agent or retrieval feature to real users.

  • Direct and indirect prompt injection, including via retrieved content
  • Insecure output handling where model output reaches an interpreter
  • Data leakage from context windows, embeddings and system prompts
  • Agent tool abuse, excessive agency and permission boundaries
4–8 days OWASP LLM Top 10 Discuss scope

Network external · internal

When you need assurance on the perimeter, or want to know what a phished employee could reach.

  • Service enumeration, version analysis and exposure review
  • Credential attacks, relay and lateral movement paths
  • Segmentation validation for PCI-DSS and equivalent scoping
  • Privilege escalation to domain or infrastructure administrator
3–10 days PTESNIST SP 800-115 Full scope

Cloud configuration

When infrastructure sits on AWS, Azure or GCP and has grown organically.

  • IAM roles, trust policies and privilege escalation chains
  • Storage exposure, encryption posture and key management
  • Network boundaries, security groups and peering
  • Logging, retention and detection coverage
4–7 days CIS Benchmarks Discuss scope

Active Directory

When a Windows domain underpins access across the business.

  • Kerberos attack surface — roasting, delegation, ticket abuse
  • AD Certificate Services misconfiguration and escalation paths
  • Group Policy, ACL and nested group rights analysis
  • Administrative tiering and credential exposure review
5–8 days MITRE ATT&CK Discuss scope

Red team operations

When your controls are mature and you want to test detection, not exposure. A different commitment from the tests above — weeks, not days.

  • Objective-based scenarios agreed with your leadership up front
  • Detection and response measurement at every stage
  • Purple team replay so your defenders learn from every step
  • Suitable as preparation for TIBER-EU and CBEST engagements
3–6 weeks TIBER-EUCBEST Discuss scope
Included as standard

The parts other firms charge extra for.

  • Free retest

    Remediated findings are retested and the report reissued at no cost, within six months of delivery.

  • Remediation session

    A working call where your engineers ask the tester directly how to fix each finding.

  • Dual reporting

    A technical report and a separate executive summary, both included as standard.

  • Attestation letter

    A signed letter confirming testing dates and scope, for customers and auditors who ask.

Still not sure what you need?

Tell us what you run and we will tell you what is worth testing — including when the answer is less than you expected. Scoping calls are free and there is no obligation afterwards.

Book a scoping call See a sample report