Unlimited Penetration Testing
Test as often as you need. No day rates, no per engagement fees, no waiting six weeks for a scoping call to free up.
Read about unlimited penetration testing
Attackers do notbook a slot.
So we do not test to a calendar. CHMS runs continuous penetration testing, red teaming and social engineering across your entire estate for one annual fee. Not one week in March.
60+
10
2
0
Everything, or the two things that matter.
The previous version of this site listed more than twenty services. This one lists two, because two is the number we do properly.
A yearly test tells you about a company that has since changed.
The report lands in April. By June you have shipped two new services, onboarded a supplier with access to your file store, and replaced half the laptop fleet. None of it was in scope, because none of it existed when the scope was written.
The industry has trained buyers to think of testing as an event. It is a procurement cycle, a scoping call, a week of work and a PDF. Attackers experience your business as a continuous surface. The two models do not match, and the gap between them is where incidents happen.
The point of testing is not the report. It is the window of time in which you are wrong about your own estate.
One agreement. Testing that never stops.
The same sequence a competent attacker follows, run against your estate on repeat rather than once.
- MapWe build and maintain a live picture of everything you expose: domains, hosts, cloud accounts, third party integrations, staff. It is rebuilt continuously, not captured once at kick off.
- TestManual testing against that surface, plus automated coverage between passes. New asset appears on Tuesday and it is tested on Tuesday. You do not raise a change request.
- EscalateWhere a finding is exploitable we prove it. Chained access, privilege escalation, lateral movement and impact, demonstrated rather than described in a severity table.
- ReportFindings reach you as they are confirmed, with reproduction steps and a fix. There is no six week wait for a document, because the document is not the deliverable.
- RetestYou fix it, we verify it, and it stays on the list until it is closed. Retesting is included, which removes the commercial reason to stop looking.
What changes when the meter stops running.
Traditional testing is priced per engagement, so every question costs money and every question therefore gets asked less often. Unlimited removes that.
- Scoped once, priced by the day, delivered as a report
- Scoped once, priced annually, delivered continuously
- Usually billed again. Included here.
- Usually out of scope until the next cycle. In scope on the day here.
- Usually a change request and a lead time. Included here.
- Usually the end of the engagement. Here it is a running record.
The on premise layer beneath a platform serving 60+ UK councils.
Invision Protect delivers continuous, evidence led penetration testing to UK local authorities and public services. Some of those organisations cannot allow their data to sit in anyone else's environment, whatever the assurances attached to it.
CHMS provides the deployment that solves it: the full platform, installed and running inside the organisation's own infrastructure, under their own control.
“For organisations that require everything inside their own environment, a fully self-hosted, on-premise deployment is available via CHMS Cyber Sec.”
Find out what a scoping call costs you.
Nothing. Half an hour, an honest read on your exposure, and a fixed annual number if it is a fit.