V1olet is a UK security firm for organisations without a security team of their own. We test your systems the way an attacker would, help when something goes wrong, and get you ready for what customers and insurers ask about.
- Nothing is tested until you've signed the rules of engagement.
- A named analyst who knows your systems and your people.
- Evidence hashed and logged under chain of custody.
Four ways to work with us
Most of our work falls into one of these. If you're not sure which you need, start with a review and we'll tell you honestly.
- Consultancy Advice, booked by the day A senior consultant looks at how you're set up and what your customers or insurer expect, then gives you a short list of what to fix first. Nothing to install. Cyber Essentials or a supplier questionnaire An insurance renewal asking about MFA and backups Not knowing where you stand Explore consultancy
- Red Offensive testing Penetration tests of your applications and networks, longer red team engagements, and reconnaissance of what you expose online. All under written rules you sign first. A customer or insurer wants a penetration test A new portal, app or API going live Finding out whether anyone would notice an attack Explore Red
- Blue Defence and response A monthly retainer for monitoring, incident response and compliance. Your Blue Lead knows your systems and is the person you call when something looks wrong. Monitoring without hiring a security team Someone to call when something goes wrong Audits and questionnaires, year after year Explore Blue
- Infrastructure Secure set-up and hardening Networks, cloud, identity, devices and backups set up properly, alongside your IT provider, then checked by our Red team from an attacker's point of view. Moving to the cloud or a new office MFA, admin accounts and backups to sort out Findings from a test that need fixing properly Explore infrastructure
What's prompting this?
People usually get in touch because something specific has happened. Pick the one closest to yours.
Red · Penetration test
A test that answers what they asked
Send us the request. We scope a test that covers it, test in agreed windows, and give you a management summary, technical findings and a retest you can hand straight back.
Consultancy · Compliance readiness
Honest answers, and the gaps closed
A consultant works through the questions with you, finds what's missing and helps you fix it. We prepare you for Cyber Essentials; the certificate itself comes from an IASME-licensed Certification Body.
Blue · Monthly retainer
Monitoring with a person behind it
Your logs go into Wazuh or Elastic SIEM. We sort through the alerts, and your Blue Lead calls you when something needs a decision. Escalation targets are agreed in the retainer.
Urgent · Incident response
Tell us now
Send the form with "We think we've been breached" selected and call +44 7563 636399 if you can. Disconnect affected devices from the network rather than switching them off, and don't contact or pay the attacker.
Infrastructure · Secure set-up
Foundations done properly
We review and harden your networks, cloud, identity, devices and backups with your IT provider, then our Red team checks the result.
Consultancy · Security review
Start with a review
A few days with a senior consultant: how things are set up, who can access what, how backups work. You get a short, prioritised list, and we'll say plainly if you need anything more.
Would anyone notice?
A penetration test shows where the weaknesses are. A red team engagement shows whether your people, your IT provider and your tools would catch someone using them.
- ReconnaissancePublic sources, exposed services, leaked credentialsNot detected
- Initial accessA targeted phishing email to an agreed group of staffNot detected
- FootholdA test implant on one workstationDetected, no response
- Privilege escalationA misconfigured service accountNot detected
- Lateral movementFrom the workstation to a file serverDetected and escalated
- ObjectiveRead access to the agreed finance shareObjective reached
Only a few people know
We agree an objective with you, such as read access to a particular file share, and work towards it over a few weeks. Your emergency contacts know it's happening, and the rules of engagement say exactly when we stop.
A debrief, step by step
Afterwards we walk your team through the attack, show what was seen and what was missed, and agree which changes would have caught us earliest. More on red teaming
Illustrative example. Every finding is reviewed by one of our analysts.
Hound, our threat intelligence engine
We built Hound for our own work. It finds what an attacker could learn about you, and records every finding so it holds up later.
Reconnaissance before every test
Old subdomains, keys left in code, documents that shouldn't be public.
Exposure checks during incidents
Whether your data or credentials have turned up anywhere.
Evidence that holds up
Hashed, logged and mapped to STIX 2.1, ready for an insurer or a court.
Why it matters at your size
The government's own survey shows how often medium-sized businesses are hit, and how few are ready.
- 67%
- of medium-sized UK businesses identified a breach or attack in the previous year.
- 53%
- of medium-sized businesses have a formal incident response plan.
- 12%
- of businesses have heard of Cyber Essentials, which many contracts and insurers now ask about.
Source: Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025.
The rules we work by
Security work means someone has access to your systems and data. These rules apply to every job, so you know what to expect before you sign anything.
Written authorisation, every time
We don't touch a system until you've approved it in writing, and that includes during an incident.
Within the law
We work within the Computer Misuse Act 1990 and UK GDPR, and sign a data processing agreement before we see any of your data.
Evidence that holds up
Everything we collect is hashed at the point of collection and logged every time it's moved or opened.
No hacking back
If you're attacked, we don't attack back. We keep the evidence and, with your agreement, hand it to the police or the National Crime Agency.
Trained in capture the flag
Our team came up through capture-the-flag competitions: a few days to break into deliberately vulnerable systems, reverse engineer software and recover evidence from disk images, against teams from all over the world. We still play, as v1olet.
It's good training for client work. You learn to read systems carefully, work under time pressure and write up exactly what you found.
Tell us what's going on
A new contract, an insurance renewal, or something that's already happened. We'll reply by email and suggest a sensible first step.