Penetration testing · Attack surface · Managed SOC · Compliance
“To know your enemy, you must become your enemy.”
— Sun Tzu, The Art of War
We find the weaknesses attackers would use in your apps, networks and cloud, then help you fix them.
- CREST-accredited penetration testing
- AI-powered testing, led by expert hackers
- Typical day rate £1,350 · Reports aimed within 5 working days
Samurai Security is a CREST-accredited UK cyber security company. We find your weaknesses with penetration testing and our external attack surface assessment (Black Dragon), which shows what attackers can see of your organisation from the internet. We watch for attacks with our managed SOC, and help you prove your security with ISO 27001, Cyber Essentials and virtual CISO support, whatever the size of your organisation.
We are an NCSC Assured Cyber Security Consultancy, certified to ISO 9001 and Cyber Essentials Plus, and an appointed supplier on the Government's Cyber Security Services 3 framework (Crown Commercial Service, now the Government Commercial Agency).
- CREST accreditedPenetration testing you can verify
- 15+ consultantsSecurity consultants across testing, defence and compliance
- 5 working daysOur aim for report delivery
- Black DragonOur own attack surface tooling
Attack. Defend. Comply.
Aligned with the UK Government Cyber Security Strategy.
Our services cover the five areas of the Government Cyber Security Strategy 2022 to 2030, which the National Cyber Security Centre (NCSC) helps deliver as the UK’s technical authority on cyber security. As an NCSC Assured Cyber Security Consultancy, we help you across all five.
Manage cyber security risks
Find and reduce your risks before attackers do.
Protect against cyber attacks
Stop attacks before they affect your operations.
Detect cyber security events
Real-time monitoring and alerts, so you respond fast.
Minimise the impact of incidents
Contain incidents and restore normal operations.
Develop the right skills, knowledge and culture
Training and certification that build a secure culture.
AI-driven testing
Attackers use AI. So does our testing.
Attackers are already using AI to find and exploit weaknesses at speed. Katana is our own AI-powered testing platform, built and run by Samurai Security, not a third-party tool. It tests the way an AI-driven attacker would.
Our consultants then add what automation misses: creativity, attack chaining and judgement. That combination is why hybrid testing is usually the sweet spot.
Trusted by organisations including
Experienced across healthcare, finance, retail, logistics and more. Read our case studies
Penetration testing
We find the weaknesses before attackers do.
Tools find a lot. Real attackers still win by thinking laterally. Our CREST-accredited consultants bring what automation can't:
- Creativity. Blue-sky thinking about how your systems could be misused.
- Attack chaining. Linking small weaknesses into a real attack path.
- A red-team mindset. Testing the way an attacker would actually get in.
- Judgement. On time-sensitive and context-dependent findings, such as business-logic flaws.
Attack surface risk assessment (Black Dragon)
See what attackers already see.
Black Dragon is Samurai's proprietary attack surface tooling. It is safe and non-intrusive, combining dark web monitoring, shadow asset discovery, external vulnerability scanning and subdomain mapping to show you the exposures an attacker would find first.
Use the findings to plan your next penetration test, or as the reconnaissance stage of an intelligence-led Attack Simulation & Global Threat Assessment (GTA).
- 01Dark web monitoring
- 02Shadow asset discovery
- 03External vulnerability scanning
- 04Subdomain mapping
“We were astonished by what Samurai’s Black Dragon assessment revealed, even though we thought we had everything covered. The findings spoke for themselves, and the team’s expertise and clarity were outstanding.”
Managed defence
Detect and respond, around the clock.
Our managed SOC and SIEM and managed detection and response services monitor, triage and respond to threats 24/7, on top of the security tooling you already run. If something does get through, our incident response and digital forensics teams help you contain it and recover.
Risk & compliance
Compliance that keeps pace with the business.
From ISO 27001 implementation and Cyber Essentials certification to a virtual CISO who sets your security strategy, we turn testing and monitoring into evidence your customers, auditors and board can rely on, and help you manage the risk your suppliers bring.
- ISO 27001Build and certify an ISMS that fits your business
- Cyber EssentialsCertification support, including Cyber Essentials Plus
- Virtual CISOSecurity leadership aligned with your business goals
- Third-party riskAssurance across applications, vendors and suppliers
- DORAGap analysis, resilience testing and ICT third-party risk
- NHS DTACTechnical security evidence for digital health products
Katana + human testing
The speed of AI. The instinct of expert hackers.
How Katana works
Katana runs like a pen testing team made of AI agents.
- 01Supervising agentsAct as team leaders. They plan the test, assign the work and keep it on scope.
- 02Hunting agentsAct as pentesters. They probe your systems for weaknesses and try to exploit them.
- 03Proofing agentsCheck every finding and remove false positives before anything reaches your report.
Katana
What Katana brings
- Speed and breadth. Works through large attack surfaces fast, checking every host, endpoint and input.
- Trained on real-world testing. Informed by 2,000+ of our own pen test reports since 2016, pseudonymised and redacted and held on our own server. Insight off-the-shelf AI tools don't have.
- Built by pentesters. Designed by a team with 20+ published CVEs, led by a cyber security academic with 20+ years in the industry.
- Thinks like an AI attacker. Replicates the tools and tactics AI-driven hackers now use.
Human testers
What our human testers bring
- Creativity. They find weaknesses no scanner or model is looking for.
- Chaining. They link small issues into a real path to your data.
- Red-team mindset. They think like a determined attacker with a goal, not a checklist.
- Findings that develop over time. Issues that only show up across sessions, states or time.
- Business context. They judge what actually matters to your organisation.
Choose your approach
Hybrid Most popular
Katana covers the ground, and our consultants test deeper and review every finding.
Fully human
Our consultants do all the testing and write the report.
Fully Katana
The fastest option. Proofing agents verify findings, and a consultant gives the report a final check.
How it works
From scoping call to retest.
A straightforward engagement, whichever testing option you choose.
Scoping call
Tell us what needs testing. We agree the scope and the right mix of human-led, Katana or hybrid testing.
Clear quote
You see the consultant days your scope needs and the day rate behind them.
Testing
Our consultants, with Katana if you choose it, test and chain findings the way a real attacker would.
Report
Aimed within 5 working days of testing finishing, with severity and remediation advice for each finding.
Retest
Once you've fixed the issues, a retest priced by the number of findings to re-verify.
Approachable, consultative and experienced
What our clients say
“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”
“We were astonished by what Samurai’s Black Dragon assessment revealed, even though we thought we had everything covered.”
Resources
Guides and insight from our experts.
How much does penetration testing cost in the UK?
Our day rate, what decides how many days a test needs, and how to compare quotes.
Read GuideHow to choose a penetration testing provider
Accreditations to look for, what a quote and report should include, and questions to ask.
Read GuideHow often should you pen test?
When to test, and the changes that should trigger a new test.
Read PodcastThe Samurai Podcast
Our experts share stories of hackers, unstable apps and digital blunders, all while having a laugh.
ListenWhere to start
Start with what you need first.
Test your defences.
CREST-accredited penetration testing, Black Dragon attack surface assessments and AI-driven testing with Katana.
Typical day rate £1,350 · reports aimed within 5 working days
Book a scoping callDefend and prove it.
Managed SOC and MDR, incident response, ISO 27001, Cyber Essentials and virtual CISO support from one team.
24/7 monitoring · ISO 27001 · vCISO
Talk to our teamNot sure where to begin? Start with a free cyber breach risk assessment. Housing association? See pen testing and Cyber Baseline Review.
Frequently asked questions
Common questions about Samurai Security and how we work.
What does Samurai Security do?
Samurai Security is a CREST-accredited UK cyber security company. We deliver penetration testing, Black Dragon attack surface assessments, AI-driven testing with Katana, attack simulation, physical security assessments, managed SOC and MDR, and risk and compliance services including ISO 27001, Cyber Essentials, virtual CISO and third-party risk assurance.
Which accreditations does Samurai Security hold?
Samurai Security is CREST accredited for penetration testing and is an NCSC Assured Cyber Security Consultancy. We are also certified to ISO 9001 and Cyber Essentials Plus.
How much does a penetration test cost?
Our standard rate is £1,350 per consultant day, lower for multi-day programmes and retainers, so the cost depends on how many days your scope needs. Small external tests are estimated from £2,700. Use our free penetration testing cost calculator for an estimate; a formal quote needs a scoping call.
How quickly will I receive my report?
We aim to deliver your report within 5 working days of testing finishing. Very large engagements can take longer, and where it suits the scope, Katana can speed things up.
What is Katana?
Katana is our own AI-powered testing platform, built and run by Samurai Security; it is not a third-party tool. It tests the way an AI-driven attacker would, while our consultants add the creativity, attack chaining and judgement that automation misses.
Do you use human testers or AI?
Both, and the choice is yours. You can choose fully human-led testing, Katana, or a hybrid of both. We usually recommend hybrid.
Who carries out the work?
Our team of 15+ security consultants, covering penetration testing, managed defence and compliance. Our headquarters and registered office is ACERO, 1 Concourse Way, Sheffield S1 2BJ, and we also have offices in London and Birmingham.
Do you work with large organisations?
Yes. We work with organisations of every size, from growing businesses to large enterprises.
Get in touch
Let's find a solution
If you want to chat, give us a call: 0114 400 0021
Or, email us: info@samuraisecurity.co.uk