Cyber posture assessment
Agentic Cyber Posture Assessment
An agentic cyber posture assessment is a security assessment in which an autonomous AI agent investigates, actively tests and attempts to exploit an organisation's public web estate under recorded consent, and a named human expert reviews every finding and signs the conclusions.
It combines the coverage and speed of AI penetration testing with something no scanner provides: judgement a board can rely.
Method
How it works
-
Investigate
An AI agent crawls your estate and runs twelve scan layers, from TLS and DNS to JavaScript supply chain and platform configuration.
-
Test
Non-destructive active probes, where commissioned, real exploitation attempts with industry attack tools, inside a sandbox, under a signed authorisation.
-
Interpret
Every machine finding is reviewed by us; false positives are removed; the rest is translated into business language and three prioritised moves.
-
Report
You receive a signed executive readout plus the full technical evidence as appendices, mapped to ISO 27001, SOC 2, NIS2, DORA, PCI DSS, NIST CSF and the EU Cyber Resilience Act.
Sample report
What you receive
Sample pages from a real assessment, client details redacted.
Transparent pricing
Assessment options
| Service | What you get | Price |
|---|---|---|
| Cyber Exposure Snapshot | Single-page scan with a short expert commentary. The best first step. | Free |
| Agentic Cyber Posture Assessment | Full twelve-layer agent investigation of one domain, expert-signed executive readout plus evidence appendices | £1,750 |
| Compliance Evidence Pack | Assessment plus framework mapping and an auditor-facing evidence memo | £2,950 |
| Board Cyber Readout | Assessment plus a 60 to 90 minute board session in plain English | £4,750 |
| Adversarial Validation | Consent-gated exploitation testing with proof-of-exploit evidence | From £5,500 |
| Continuous Assurance | Scheduled scans, change reports and a quarterly signed posture letter | From £450 per month |
Board Pack (Assessment plus Evidence Pack plus Board Readout) £5,950.
Additional domains from £650. Prices exclude VAT.
Common questions
Frequently asked questions
Is this a penetration test?
It includes real exploitation attempts by attack tooling, but it is not an accredited CREST or CHECK penetration test and we do not present it as one. It is automated security intelligence with expert interpretation, priced accordingly.
What is agentic pentesting?
Security testing in which AI agents plan and run the tests, adapting to what they find rather than following a fixed script. Our assessment uses agentic techniques for coverage and adds expert human sign-off for judgement. The same phrase is also used for testing of agentic AI systems; we do that too, on our AI Testing and Audit page.
Is any of this dangerous to my website?
Passive layers observe only. Active and exploitation layers run a fixed, non-destructive technique profile, only ever under a signed authorisation naming the domains and the testing window.
How fast is it?
Snapshot same day; full assessment within five working days.
We are in scope for NIS2 or DORA. Does this help?
Yes. Findings arrive mapped to those frameworks and the Compliance Evidence Pack adds a memo on what the evidence does and does not prove to a supervisor or auditor.
A first step