CREST Network
Penetration Testing

It is a test delivered by a company that CREST has assessed against its standards for procedures, staff, testing approach and data security. Members apply every year and face a full reassessment every three years. Vonahi Security, a Kaseya company, appears on the CREST register for penetration testing in the UK and Europe. Customers there can choose the CREST-certified test option in vPenTest and receive a report carrying the CREST logo on its cover.

At least once a year and after significant changes, which is what PCI DSS requires, but annual testing leaves long blind spots. In 2023 Mandiant measured an average time-to-exploit of five days, down from 63 days in 2018 to 2019. A firewall change made in March would otherwise wait until next year’s test. Vonahi’s vPenTest supports monthly and on-demand network tests, which makes a shorter cycle affordable: test monthly, and retest after any change to your perimeter.

For network infrastructure, yes on coverage and repeatability; for web applications, social engineering and physical testing, no. An automated test runs the same way every time, so results are comparable month to month, and it can run far more often than a manual engagement. A human tester still adds judgement about how a specific application or business process could be abused. Use automated network tests for frequency, and bring in specialists for the applications that matter most to you.

No. Cyber Essentials Plus adds independent testing to the self-assessment, as set out in the NCSC test specification. The assessor runs a remote vulnerability assessment and an authenticated vulnerability scan of a sample of devices, then checks malware protection, multi-factor authentication and account separation. None of the five test cases tries to exploit a weakness or move through your network. Cyber Essentials Plus shows the controls are in place; a penetration test shows what an attacker can still do.

An external test attacks your internet-facing systems, starting from what an attacker can learn on the public internet, such as employee names and email addresses. An internal test assumes the attacker is already inside, for example through a phished laptop, and measures how far they can move. vPenTest runs both, simulating pre- and post-breach scenarios. For internal tests you deploy a small agent on your network and schedule the assessment. Testing only the perimeter tells you nothing about what an intruder could reach once inside.

Days rather than weeks for an automated network test. Vonahi says customers can “deploy an agent, schedule an internal assessment, and get detailed reports within a few days”, with the report produced within 48 hours of the test finishing. Elasticito delivers results in less than seven days, so a test fits inside an audit deadline. A manual engagement is scoped and scheduled separately, so ask for its dates before you commit to an audit timetable.

For PCI DSS and SOC 2 audits and for cyber insurance, Vonahi states that vPenTest meets the requirements; check your auditor’s or insurer’s wording before you book. Each report includes an executive summary, technical findings with remediation guidance, and results mapped to framework requirements. Where a contract or customer asks for CREST by name, choose the CREST-certified test option, available in the UK and Europe.