Insight Code Top
Insight Code Bottom
Using a CREST-Approved penetration testing provider

What is CREST penetration testing and why is it important to use a CREST-approved provider?

12th July 2021

5 min read

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration testing with a CREST-Approved provider is one of the most effective methods to gain assurance of your IT security.

Initiating a CREST penetration test will give you the ability to develop (or enhance an existing) security strategy and remediate your vulnerabilities. You’ll gain confidence in your IT security knowing you understand and have visibility of the vulnerabilities in your IT systems and networks, and understand where remedial action is needed.

When looking for a penetration testing provider, it’s essential to have confidence in the skills and knowledge of the provider who performs your assessment. Choosing a CREST-approved penetration testing provider gives you the assurance that their cyber security services are of the highest quality and technical standards.


What is CREST penetration testing?

CREST Penetration testing is the process of methodically scrutinising an IT system’s security using similar techniques and tools that a malicious actor would use. Penetration testing is primarily used to gain assurance in the effectiveness of IT security controls and identify vulnerabilities.

Penetration testers are armed with the task of finding methods that an attacker can use to gain access to your computer network(s) and sensitive information. If you have a good understanding of your IT security controls, you may know some of the weaknesses your penetration test will find. In this case, the test can confirm your suspicions.

This will depend on the maturity of your organisation’s security strategy and how much internal investment you put into your security. Primarily, penetration testing is used to discover weaknesses that you weren’t aware existed, and will often confirm the extent of damage that may be caused by compromising them.


What is CREST?

CREST is an internationally recognised not-for-profit accreditation and certification body that represents and supports the technical information security market.

Companies can choose to become a CREST member company and apply for CREST accredited services. The application requires a rigorous assessment of companies’ processes, data security and service methodologies to ensure they’re to a best practice standard.


Why and when do you need penetration testing?

A penetration test is needed to gain assurance in the effectiveness of your IT security controls to ensure a malicious actor can’t access or make changes to your systems and assets during a cyber attack.

You may also require a penetration test for compliance reasons. Data regulations often require you to meet security standards that ensure Personally Identifiable Information (PII) is protected and secured within your IT environment to prevent data breaches or loss from occurring.

Conducting regular (often annual) testing is a common cycle for penetration testing. The frequency with which penetration testing is performed is dependent on the size, complexity, risk appetite and security budget of an organisation.

Regular testing ensures your security controls continue to reflect a changing environment. If you’ve had your systems in place for a while or have made significant changes, you might want to carry out a penetration test to determine its security posture.

You’ll learn whether your security is as effective as you expected or if it needs improvement to mitigate attacks.


How is CREST penetration testing carried out?

Penetration testing is typically carried out by external, specialist testers. Penetration testers know how to initiate an attack using the tools and techniques malicious actors use. You should choose a CREST-accredited cyber security specialist with the knowledge and skills to target the right technologies and gain assurance in your desired areas.

Testing identifies weak security controls, misconfigurations and vulnerabilities within IT environments. This can include network devices, applications, remote access solutions, mobile devices, cloud and more.

At Sentrium, instigating a penetration test consists of the following steps:

  • You approach us with a requirement to understand your IT estate in-depth
  • We determine the assurance you want to gain from conducting a penetration test and why you want this information
  • We plan the best way to conduct the test that will uncover weaknesses and vulnerabilities in your systems
  • We execute an attack on your target network
  • We create and issue your report based on the issues identified during the assessment detailing where they appeared and why they occurred.

The report you receive following your penetration test will cover the vulnerabilities found and how to remediate them effectively. Penetration testing is a heuristic process and the final report should document the findings in detail, as well as recommended actions; you shouldn’t expect to receive a pass or fail result.


Why is it important to use a CREST-approved provider?

Working with a CREST-approved penetration testing provider ensures you’re in safe and experienced hands. You should have the confidence that your penetration test is thorough and comprehensive. Your provider must carry out a test that’s technically accurate and covers the required scope of your IT controls to ensure your primary security concerns are assessed.

Legal issues are of high importance when conducting penetration testing. The testing company will know how to gain access to your IT systems and the weak spots within your security across the organisation that have been discovered in your test. Your penetration testing provider will need to seek specific authorisation from you to conduct the test.

The CREST accreditation gives you the assurance that your provider has the appropriate policies, processes and procedures to carry out penetration testing and protect your information. You can gain peace of mind that the support provided is the best in the industry.


Sentrium is a CREST-approved penetration testing provider

Sentrium recently achieved the status as a CREST-approved penetration testing provider. We’re proud to provide services that achieve CREST’s very high standard of quality and professionalism which is recognised internationally.

Our penetration testing experts have a deep understanding of how attackers operate. We use this knowledge to help your business mitigate risks to your IT systems and networks. We want to help you improve your overall security strategy to protect your brand reputation, value and property.

Ultimately, choosing an organisation with CREST accreditation provides assurance for your business when looking for a penetration testing provider. You can trust that a CREST-approved organisation provides quality penetration testing services and has the technical expertise to sufficiently meet your security needs.

For more information, please get in touch with us today.


  • Insights
  • Labs
ISO 9001 and ISO 27001

Sentrium Achieves ISO 9001 and ISO 27001 Certifications

In an increasingly digital world, the importance of quality and security cannot be overstated. Sentrium Security Ltd is excited to share our recent achievement –…

What are the different types of penetration testing?

What are the different types of penetration testing?

As digital business becomes more widespread, the need to ensure data security increases. One way to test its effectiveness is through penetration testing. Penetration tests…

OWASP Global Image

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP…

cloud computing technology concept transfer database to cloud. T

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up…

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

Code, HTML, php web programming source code. Abstract code background - 3d rendering

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…

Get in touch with our experts to discuss your needs

Phone +44(0)1242 388634 or email [email protected]

Get in touch