Pen Test Partners

A UK cybersecurity consultancy that tests the security of cars, ships, aircraft, factories and software by ethical hacking.

About Pen Test Partners

Pen Test Partners is a cybersecurity consultancy. Its experts try to break into systems, with permission, to show customers where they are weak (penetration testing, or pen testing). Its work covers areas such as cars, aircraft and ships, red team and hardware testing, and industrial control systems (the computers that run machinery and infrastructure). The company says it has tested ships, planes, cars and EV chargers.

Pen Test Partners says it has provided cybersecurity services since 2010. Its best-known public voice is Ken Munro, a senior partner who previously founded SecureTest, which is now part of NCC Group. It is a founding member of the CREST scheme, the industry's quality standard for testers, and has helped shape CBEST, a testing framework for the financial sector. Its UK office is at Verney Junction Business Park in Buckingham, and it has a US office in New York. Its careers page says most UK staff mainly work from home with regular local and company meet-ups, and all roles are UK based. It says it has over 140 employees.

We did not find a formal mission statement; the About page links to a separate vision and values page that we could not read. It stresses personal connection, noting that "faceless relationships do nobody any good". Its careers page says it offers an "environment where you can flourish, learn, and grow".

Its services fall into four areas: Test and Simulate (penetration testing, red and purple teaming, cloud, physical, operational technology and transport systems testing), Detect and Respond (incident response, digital forensics, managed detection and response), Improve and Protect (security architecture, training, virtual CISO services) and Comply (Cyber Essentials, PCI assessments). Its team has published well-known research: it reverse engineered the Ploutus ATM malware, found flaws in traffic light control systems that were fixed before wider use, showed how IP-connected building systems could unlock doors, and found that plugging a USB cable into the Tesco Hudl tablet could expose stored data. Its accreditations include ISO 27001, CHECK, CREST and PCI QSA.

For young people, the culture is hands-on and curious. It says people often speak at events and publish vulnerability disclosures, and it offers 24 development days a year, conference time, training budgets and internal workshops, plus a blog bounty programme (company claims). As at 2025 it advertised a paid placement-year internship for second or third year university students (Application Developer, Red Team), running from July to September 2025 until September 2026. Its testing roles asked for experience, so entry-level routes are mainly internships. Check its careers page for current schemes.

What they do

• {'desc': 'Ethical hacking to find weaknesses in systems, apps and cloud.', 'title': 'Penetration testing'}
• {'desc': 'Realistic attack simulations; testing cars, ships, aircraft and devices.', 'title': 'Red team and hardware testing'}
• {'desc': 'Investigating how incidents happened and responding to them.', 'title': 'Incident response and forensics'}
• {'desc': 'Cyber Essentials, PCI assessments, security training.', 'title': 'Compliance and training'}

Key facts

• Providing cybersecurity services since 2010
• Founding member of CREST; also CHECK, ISO 27001 and PCI QSA
• UK office: Buckingham; mostly home working; all roles UK based
• Over 140 employees (own claim)
• Paid placement-year internship advertised for 2025-26

Website: www.pentestpartners.com