Viper Attack
Services

Testing scoped to the question you need answered

Network penetration testing, control validation and phishing simulation measure different things. We keep them separate so you know exactly what you're buying and what the results mean.

Availability: We're currently taking a small number of Baseline Assessment pilots. The other services are planned and depend on the delivery partners we select. Every engagement is priced from its written scope, so we don't publish fixed prices.

What each type of testing measures
Type of testingThe question it answersWhat it doesn't tell you
Network penetration testingCan known weaknesses actually be used to gain access or move through the systems in scope?How every control behaves against every technique, or anything outside the agreed scope.
Control validationDid a specific control block, detect or allow a defined behavior on the systems tested?Whether the control will perform the same way against different techniques or after configuration changes.
AI data exposure testingCan staff paste or upload sensitive data into AI chat tools, and do your controls block, warn or log it?Whether a particular AI vendor stores, trains on or protects data once it arrives.
Phishing simulationHow do employees respond to realistic, authorized test emails, in aggregate?Anything about technical controls, or a judgment on any individual employee.
Pilot available, subject to scope

Baseline Assessment

A single, scoped network assessment that shows where you're exposed today and what to fix first. A good starting point when you need evidence for leadership, a customer questionnaire or an upcoming renewal.

Request a scoped quote

Included

  • Written scope and authorization before any testing
  • One agreed network assessment of in-scope systems
  • Analyst validation of every reported finding
  • Executive briefing and a prioritized action list
  • Technical report for your IT team or provider
  • One bounded retest of agreed fixes within 30 days

Good fit when

You have roughly 25 to 250 employees, an internal IT team or outside provider, and a reason to check that your security investment is doing its job.

Planned

Continuous Validation

Environments change. New devices, staff and tools appear every month. Continuous Validation is planned as a recurring service that starts from a baseline and keeps checking on an agreed schedule.

Ask about availability

Planned scope

  • Baseline onboarding
  • Scoped testing on an agreed schedule, such as quarterly
  • Regular findings reviews with your team or provider
  • Remediation tracking and agreed retests

Limits

Frequency, assets and retests are set in the annual scope. This is not unlimited testing.

Planned, partner dependent

Human Risk Testing

Many incidents start with an email. Human Risk Testing is planned as an add-on that runs authorized phishing simulations and awareness training for an agreed group of users.

Ask about availability

Planned scope

  • Phishing simulations approved in advance by your organization
  • Short awareness training for participants
  • Aggregate reporting on trends, not individual call-outs

Depends on

Selection of a phishing and training delivery partner, and your email environment allowing test messages to arrive.

Planned, scoped case by case

Custom Control Validation

For organizations that want to know whether particular controls respond the way they expect: endpoint and anti-malware protection, firewall and outbound filtering, network segmentation and zero trust policies, and email security.

Request a scoped quote

Planned scope

  • Defined tests agreed in writing
  • Endpoint and malware controls tested with safe simulations and industry-standard test files, never live malware
  • Firewall and outbound traffic checks, such as connections a remote attacker would need
  • Segmentation checks between network zones to see whether zero trust policies hold
  • Each result labeled blocked, detected, allowed, inconclusive or not tested
  • Technical review and a retest of agreed changes

Depends on

Whether the controls and techniques you care about can be tested meaningfully with the platforms we select. We confirm this during scoping.

Planned, partner dependent

AI Data Exposure Testing

Staff copy and paste into AI tools such as ChatGPT, Claude, Gemini and Copilot every day. This planned service checks whether your controls stop customer records, personal information, financial data or secrets from leaving through a prompt or an upload.

Ask about availability

Planned scope

  • Inventory of AI tools seen in your environment, approved and unapproved
  • Paste, typing and file upload tests using synthetic data only, never real personal information
  • Personal accounts compared with your company's approved AI workspace
  • Results labeled blocked, detected, allowed, inconclusive or not tested
  • Plain-English fixes for your DLP, browser or web proxy settings, then a retest

Good fit when

You handle customer, patient or financial data, your staff use AI tools, and you've either bought a data protection control or need to decide whether to.

Clear boundaries

Not included unless specifically scoped

The base services don't cover everything security-related. If you need any of the following, raise it during scoping and we'll tell you honestly whether we can help.

  • Web application or API testing
  • Cloud environment penetration testing
  • 24/7 monitoring or managed detection
  • Incident response
  • Fixing the issues we find (your team or IT provider owns remediation)
  • Compliance certification or audit sign-off
  • Testing with real malware or real personal data

Not sure which service fits?

Start with a conversation. We'll ask what's driving the need and suggest the smallest scope that answers it.

Discuss a pilot assessment