of UK businesses were breached or attacked last year.
UK government, April 2026Cost to the UK of the Jaguar Land Rover attack.
Cyber Monitoring Centre, 2025Find your flaws
before the swarm does.Attackers use AI now.
So do we.Your flaws,
found and fixed.
We sweep your systems for known flaws, show you what's real and fix it. Based in the UK.
See pricing10.0CVSS
CVE-2024-3400
Palo Alto firewall VPN portal
- Risk
- Anyone online can take over your firewall, then reach the customer and finance systems behind it.
- Asset
vpn.yourcompany.co.uk- Fix
- Update the firewall, then reset its keys.
OpenFixed and retested
9.8CVSS
CVE-2023-34362
MOVEit file transfer server
- Risk
- Attackers take every file on the server: customer records, payroll and contracts.
- Asset
files.yourcompany.co.uk- Fix
- Update MOVEit, remove any web shells, then reset its passwords.
OpenFixed and retested
9.8CVSS
CVE-2024-34102
Online shop on Adobe Commerce (CosmicSting)
- Risk
- Attackers steal your shop's keys, then skim customers' card details at checkout.
- Asset
shop.yourcompany.co.uk- Fix
- Update Adobe Commerce, then rotate the encryption key.
OpenFixed and retested
10.0CVSS
CVE-2024-1709
ScreenConnect remote support, login bypassed
- Risk
- Attackers take over every computer it manages, finance included, and can push ransomware.
- Asset
support.yourcompany.co.uk- Fix
- Update ScreenConnect to 23.9.8 or later, then audit its users.
OpenFixed and retested
9.1CVSS
CVE-2021-26855
Exchange email server (ProxyLogon)
- Risk
- Attackers read every mailbox: invoices, contracts and customer emails.
- Asset
mail.yourcompany.co.uk- Fix
- Update Exchange, remove any web shells, then check every admin account.
OpenFixed and retested
9.4CVSS
CVE-2023-4966
Citrix gateway leaking sessions (Citrix Bleed)
- Risk
- Attackers hijack staff logins, two-step included, and walk into finance and HR systems.
- Asset
remote.yourcompany.co.uk- Fix
- Update NetScaler, then end every active session.
OpenFixed and retested
9.6CVSS
CVE-2024-21762
Fortinet VPN open to remote code
- Risk
- Attackers get onto your network with no password, then go after customer data.
- Asset
vpn2.yourcompany.co.uk- Fix
- Update FortiOS, or turn off the SSL VPN until you can.
OpenFixed and retested
10.0CVSS
CVE-2021-44228
Log4Shell in an internal reporting app
- Risk
- One crafted line of text gives an attacker the server and the customer data on it.
- Asset
reports.yourcompany.local- Fix
- Update Log4j to 2.17.1 or later, then rescan.
OpenFixed and retested
It's already happening.
From a serious flaw going public to attackers using it.
Rapid7, October 2026Co-op members whose data was taken.
Co-op, 2025New CVEs expected in 2026, a record.
FIRST, June 2026What M&S expected its attack to cost.
M&S, 2025Children's details stolen from Kido nurseries.
BBC, 2025Lost when a 158-year-old haulier closed after one guessed password.
KNP Logistics, BBC, 2025Where do you stand?
Book a sweepWhat an agent swarm does.
Teams of AI agents map, probe and break in on their own, around the clock.
- 21systems mapped
- 85accounts broken into
- 2,500+personnel records taken
- 4 daysstart to finish
Up to eight agents, working together on Taiwan's government systems in July 2026. The Register
In another campaign, AI did 80 to 90% of the work. Anthropic, November 2025
Sweep. Report. Fix.
Sweep
Everything you run, checked against every CVE that applies, then confirmed by hand.
Report
Plain English, ranked by risk, and a call to walk you through it.
Fix
We fix what's reasonable to fix, then sweep again to prove it.
- Websites
- Apps
- Code
- Cloud
- Networks
- Email and staff accounts
Abliterated models, on our own hardware.
Open AI models with their refusals removed, so they read your code the way an attacker would. Your code never goes to an AI company.
Member, responsible AI
What's a CVE?
The public ID for a known flaw. CVE-2023-34362, in the MOVEit transfer tool, let one gang take payroll data on staff at BA, the BBC and Boots.
48,000+ published in 2025.
Simple prices.
Sweep
£1,200+VAT
We find, document and present.
- Everything you run online
- Code read by our local AI
- Report and walkthrough call
Sweep and fix
£8,000+VAT
Everything in Sweep, then we fix it.
- Up to 20 fixes
- A plan for supplier issues
- A second sweep to prove it
Complete
£15,000+VAT
Your whole estate, kept clean for a year.
- Every site, app, codebase and cloud
- Up to 40 fixes, retested
- A fresh sweep every quarter
Enterprise or day rate
Larger estates, regulated sectors, ongoing work, or a set number of days.
Scope and price agreed in writing before we start. Prices exclude VAT in the UK and local taxes elsewhere.
Questions.
Is it legal to test our systems?
Yes, with your permission. Testing without it is a crime under the Computer Misuse Act 1990, so we start only once you've agreed the scope in writing.
Is it safe to test live systems?
We agree what we test and when. We confirm each flaw without changing your data, and stop and call you if anything looks fragile.
Do you need our code?
Only if you'd like it reviewed. It stays on our own hardware and is never sent to an AI company.
Do you work outside the UK?
Yes. We're based in the UK and work with local businesses and enterprise teams here and abroad.
What if we're under attack right now?
Report it first: Report Fraud on 0300 123 2040 in England, Wales and Northern Ireland, or Police Scotland on 101. Then tell us what's happening.
Book a sweep.
Tell us what you run. It takes two minutes and commits you to nothing.
- 1We reply by email.
- 2We agree scope and price in writing.
- 3We sweep, report and fix.
Prefer email? cyber@amberlake.co.uk
Request received.
Thanks. We'll reply by email to agree scope and price.