Lab status: online
Practical, affordable cyber security for small and medium UK businesses — from a self-built lab of isolated networks, Windows & Linux targets, and a live SIEM used to run real attacks and prove they get caught.
01 — Environment
02 — Topology
hover a node to see its role →
03 — Engagements
Security Assessment
£110/ engagement
A hands-on review of your business network — Wi-Fi, firewall rules, exposed services, and weak credentials — with a plain-English report of what to fix first.
Most requested
Penetration Test (Web App / Network)
£300/ engagement
Authorised, scoped testing of your business website or network to find and safely demonstrate real exploitable weaknesses — the same methodology used in the case studies above.
SIEM / Logging Setup
£180/ setup
Get a Wazuh-based monitoring stack deployed for your business — so you can actually see what's happening on your network instead of finding out after the fact.
Security Consultation
£45/ hour
Not sure where to start? A one-on-one call to talk through your specific concerns — from "is this email a scam" to planning a bigger security project.
Prices are a starting point and scale with scope — request a free walkthrough below to get an exact quote for your situation.
04 — Reports
Domain Admin via Kerberoasting
Active Directory · full attack chain
Go from an unprivileged domain foothold to Domain Admin without triggering a response.
Enumerated the domain with BloodHound, identified a service account with a weak password, extracted its Kerberos ticket, and cracked it offline.
Wazuh flagged abnormal TGS request volume from a single host (Sysmon Event ID 4769) and correlated it with BloodHound-style LDAP enumeration.
Rotated the service account to a 30-character managed password and re-ran the attack — ticket cracking became computationally infeasible within the test window.
SQLi to Shell on a Vulnerable Web App
Linux target · OWASP Top 10
Assess a deliberately vulnerable web app for injection flaws and chain them into remote code execution.
Found an unsanitized login field, used a UNION-based SQL injection to dump credentials, then leveraged a file-upload flaw for a reverse shell.
auditd captured the unexpected child process spawned from the web server, forwarded to Wazuh, which fired a "web shell behaviour" rule.
Added parameterized queries and a file-type allowlist on uploads; confirmed the same payloads were rejected on re-test.
Ransomware Tabletop & IR Walkthrough
Windows target · incident response
Simulate a ransomware detonation and practice the full IR lifecycle end to end.
Executed a benign file-encryptor proof-of-concept against a snapshot of the Windows VM to mimic ransomware behaviour safely.
Wazuh's File Integrity Monitoring flagged mass file modification within seconds; Sysmon showed the parent process tree.
Documented containment, eradication, and recovery steps, then wrote a runbook for future incidents.
05 — Feedback
Example reviews shown for illustration — replace with genuine client feedback once available.
"The assessment found a misconfigured firewall rule our previous IT contractor had missed for years. Clear report, no jargon, fixed within a week."
Operations Director, Independent Retail Business — Bristol
"We move stock for a dozen retailers and couldn't afford downtime. The penetration test on our logistics portal found a real access control flaw before it became a real problem."
IT Manager, Supply Chain & Logistics Firm — Leeds
"As a small shop we assumed we weren't a target. The consultation call was honest about what actually mattered for a business our size, without trying to oversell us."
Owner, Homeware Retail Shop — Leicester
"The SIEM setup meant our overnight warehouse systems are finally monitored properly. We got an alert about unusual login activity within the first fortnight — it worked exactly as promised."
Warehouse Systems Lead, Wholesale Distribution Business — Manchester
"Straightforward, well-documented, and reasonably priced compared to the bigger consultancies we spoke to first. Exactly what a growing business needs."
Finance & Operations, Distribution Company — Nottingham
06 — Engineering
# fires when a single host requests an unusual volume # of Kerberos service tickets in a short window title: Possible Kerberoasting Activity id: seclab-0001 logsource: product: windows service: security detection: selection: EventID: 4769 TicketEncryptionType: 0x17 timeframe: 5m condition: selection | count(TargetUserName) by ClientAddress > 10 level: high tags: - attack.credential_access - attack.t1558.003
07 — Build log
Week 1
Network foundation
Hypervisor installed, pfSense deployed as the isolated network's edge.
Week 2
Targets stood up
Windows Server + AD and a Linux target provisioned and baseline-hardened.
Week 3
Telemetry & SIEM
Sysmon and auditd deployed, logs forwarded into a new Wazuh instance.
Week 4
First attack chain
Kali box added; ran and documented the Kerberoasting case study above.
Week 5+
Detection engineering
Wrote custom rules, mapped every finding to MITRE ATT&CK, published write-ups.
08 — Access
Want a live walkthrough of the lab, the full incident reports, or a quick chat about the work above? Leave your details and I'll follow up directly — no cost, no obligation.