Phase 01
Discover
We map what you actually have: assets, identities, data flows, and the gaps between the diagram and reality. Discovery is where most surprises hide.
Offensive security, honestly reported
Security that holds up when it actually matters.
PB Sec helps growing companies find the gaps that really matter, close them in the right order, and know within minutes — not months — when something is wrong.
Plain-English reporting. No fear-selling, no jargon walls.
Web & mobile testing
Network & infrastructure
AI & LLM security
Red teaming
Threat detection
We map your programme to
- OWASP Top 10
- OWASP MASVS
- MITRE ATT&CK
- PTES
- NIST CSF 2.0
- ISO/IEC 27001
What we do
Six things we do properly
Pick one, or let us run the whole security function. Every engagement ends with something you can act on — not a 90-page PDF nobody reads.
Web application penetration testing
We attack your web apps and APIs the way a real adversary would, then show your developers exactly how to fix what we find.
- Web apps
- REST & GraphQL
- Auth & sessions
- Business logic
Android & iOS penetration testing
Android and iOS break in different places. We test both, on real devices, and we do not stop at the app boundary.
- Android
- iOS
- API layer
- Reverse engineering
Network penetration testing
External and internal testing that answers the only question that matters: once an attacker has a foothold, how far do they get?
- External
- Internal
- Active Directory
- Lateral movement
AI security testing
Prompt injection, data leakage, tool abuse and model supply chain risk — tested against your real deployment, not a demo notebook.
- LLM apps
- Prompt injection
- Agents & tools
- RAG leakage
Threat detection
Detection engineering across endpoint, identity, cloud and network telemetry — tuned until every alert is worth reading.
- Detection engineering
- MITRE ATT&CK
- Alert triage
- Threat hunting
Red teaming
A goal-based adversary simulation against your people, processes and technology — measured against a real objective.
- Objective-based
- Social engineering
- Physical
- Purple-team debrief
How we work
Four phases, in this order, every time
Most security budgets fail because the work happens in the wrong sequence — a tool bought before the problem is understood. We fix the order first.
Phase 02
Prioritise
Findings get scored on real-world exploitability and business impact — not raw CVSS. You get a ranked list you could hand to an engineer tomorrow.
Phase 03
Harden
We work the list with your team or take it on ourselves: identity first, then exposure, then detection. Measurable change, sprint by sprint.
Phase 04
Prove & monitor
We re-test what we fixed, keep watching what we can't, and report in language your board and your auditor both accept.
Free tool
Check your company's security in 2 minutes
Six simple questions. No technical knowledge or email required. Get a basic self-check and suggested next steps based on your answers.
Question 1 of 6
Do you know which devices and accounts can access company data?
Think about work laptops, phones and accounts used to open company files.
Question 2 of 6
Do staff use a second step to sign in to work accounts?
For example, approving a sign-in in an app as well as entering a password.
Question 3 of 6
Are work devices and apps kept up to date?
Updates fix known problems in laptops, phones and the apps staff use.
Question 4 of 6
Does someone review alerts about unusual work-account sign-ins?
For example, a warning about a sign-in from an unfamiliar device or place.
Question 5 of 6
Do staff know who to contact and what to do if the company is hacked?
A short plan should name a contact and explain the first steps to take.
Question 6 of 6
Have you checked that important files can be recovered from a backup?
A backup is a separate copy of your files. A recovery test checks you can get them back.
0of 12
Some gaps to review
Your self-check result
Not sure answers are unconfirmed, not confirmed failures. They count as zero in this basic self-check.
What to do next
This basic self-check uses only your answers. It is not an independent security audit and does not confirm that your company is secure.
Why PB Sec
Four reasons clients stay
We are deliberately small, deliberately independent, and deliberately boring about the things that should be boring.
Vendor-neutral by design
We do not resell licences and take no commission. If you already own the right tools, we will use them. If you don't, we will tell you what you can safely skip.
Offence informs defence
Our testers and our defenders sit in the same room. A finding from an attack becomes a detection rule the same week — that is what purple teaming means in practice.
Reporting humans read
Executive summary on page one, technical detail in the appendix. Your board gets risk in business terms; your engineers get reproduction steps.
Priced so you can keep going
Security is a programme, not a project. Our retainers are scoped in days per month so the work continues after the report lands.
Questions
The things people ask us first
For most small and mid-sized companies, an external assessment plus a cloud and identity review lands in two to four weeks, depending on how many systems are in scope. We will give you a fixed scope and a fixed date before we start.
Yes — that is most of who we work with. Small teams usually get the biggest return from identity hardening, MFA, backups, and basic monitoring, because those four things close the majority of realistic attack paths without needing a security department.
No. We are independent and vendor-neutral. If a tool you already own solves the problem, we will configure it rather than sell you a replacement. When a purchase genuinely is the right answer, we will say so and show you the reasoning.
We prepare you for it: gap analysis against the framework, the policy and control set, and an evidence pipeline so audit time is a review rather than a scramble. We are not an audit firm, so the certification itself stays genuinely independent — which is the point.
Retainer clients get a direct line to an on-call engineer, not a ticket queue. We triage, contain, and coordinate — and we will tell you honestly what we know, what we don't, and what we are doing next. Communication during an incident is half the job.
Preferably. We are at our best as an extension of an internal team — bringing offensive testing, monitoring, and programme structure while your people keep ownership of the environment. We document as we go so the knowledge stays with you.
Start with the gaps, not the shopping list.
Book a 30-minute review. We will look at what you have and tell you the three things worth doing first.