Insurers now ask for it
Cyber policies increasingly require evidence of testing at renewal — and the request lands on your desk.
For IT providers
Penetration testing under your brand.
Your clients are being asked for a penetration test by their insurer, their auditor or their largest customer. Standing up an offensive security practice to answer that is expensive and slow. Blue Ridge works as your subcontracted testing partner — fixed scope, fixed price, your logo on the report, and no approach to your client before, during or after.
The problem
Your clients need a test. Building the capability doesn’t pay.
Auditors want independence
An assessment carries more weight when the tester isn’t the party that built and manages the environment.
Hiring for it is slow
A capable tester is a hard hire and an expensive one to keep busy. Utilisation is the problem, not capability.
Referring out costs you
Sending the work to a firm that also sells managed services puts your account in front of a competitor.
Scope
Scoped to what your client is actually being asked to prove
External network
What an attacker reaches from the internet: exposed services, misconfiguration, weak authentication and forgotten hosts.
Internal network
What happens after one workstation falls: lateral movement, privilege escalation and the path to domain control.
Web applications
OWASP Top 10 coverage plus the business logic flaws automated scanners never find.
Social engineering
Phishing and pretext testing against the client’s staff, reported by department rather than by individual.
Wireless
Separation between guest and corporate networks, authentication weaknesses and rogue access points.
Cloud & identity
Microsoft 365 and cloud tenancy configuration, conditional access, and identity paths that bypass the firewall.
The engagement
How a partner engagement runs
- 1
Partner agreement
Mutual NDA and written non-solicitation terms before anything about your client is shared.
- 2
Scoping call
Just you and us: target, depth, rules of engagement and reporting format.
- 3
Fixed quote
One number, in writing, before testing begins. Your margin is yours to set.
- 4
Testing
Hands-on testing with a direct line to you. Anything critical is escalated immediately.
- 5
Report & retest
Your-branded report, then a retest of what your team remediates.
Ground rules
What we will and won’t do
We won’t solicit your clients
It’s in the agreement, in writing, before anything is scoped. A partnership that costs you an account is worth nothing to either of us.
You deal with the tester
The person you scope with is the person doing the work. That’s good for responsiveness, and it limits how many engagements run at once.
We’ll say if a test is the wrong answer
If the client has no MFA and no backups, a penetration test produces a long report and no improvement. We’ll say so.
Every engagement is priced up front
Fixed scope and a fixed number in writing, so you can quote your client with confidence.
