Hedgehog Cyber
Hedgehog Security is a UK-based offensive cybersecurity firm founded in 2009, delivering manual penetration testing and Cyber Essentials certification to enterprise and SMB clients across financial services, healthcare, government contractors, and regulated industries.
- Company typePrivate
- Founded2009
- HeadquartersGibraltar, Gibraltar
- Headcount11–50
- GTM typeB2B
- OfferingServices
What Hedgehog Cyber does
Hedgehog Security Ltd (also branded Hedgehog Cyber) is a UK-based offensive cybersecurity firm founded in 2009, headquartered at The Officers Mess, RAF Duxford, and operating as the offensive-security and Cyber Essentials arm of the UK Cyber Defence group. The company delivers two core service lines: manual penetration testing (covering external and internal infrastructure, web and mobile applications, APIs, cloud configurations, wireless/airspace, UAV/drone, and red team operations) and end-to-end Cyber Essentials and Cyber Essentials Plus certification, with complementary vulnerability scanning, PCI-DSS and Gambling Commission RTS-aligned testing, and Windows build reviews. All work is performed by CREST, CHECK, OSCP/OSCE and IASME-accredited testers recruited from the DEFCON community, and engagements follow industry-standard methodologies (OWASP, PTES, OSSTMM, NIST SP 800-115, CIS Benchmarks).
The firm's technology stack is intentionally conventional: it relies on established penetration testing frameworks and proprietary tooling such as a Web Application Firewall with structured attack logging for its own estate, a Responsible Disclosure Programme, and a public 'Attack Leaderboard' of failed breach attempts. Revenue is generated through fixed-price professional services engagements priced after a free 30-minute scoping call, with no hourly billing and free retests bundled into every engagement. Cyber Essentials engagements are typically annual renewals, providing recurring revenue. Distribution is direct-to-customer via the company website, email, and telephone, with a 484-article blog serving as the primary content marketing engine.
The firm is privately held and registered in England and Wales, with no disclosed venture capital or private equity investment. Leadership comprises CEO Peter Bassill (also leading UK Cyber Defence group), CRO Tim Warner, and Project Manager Kelly Wickens, supported by named delivery consultants. Customers span financial services, healthcare, legal technology, SaaS, and retail, with no single anchor account disclosed. Hedgehog Security cross-sells the SOCinaBox managed SOC service as a complementary offering within the UK Cyber Defence ecosystem.
Hedgehog Cyber firmographics
Firmographics- Name
- Hedgehog Cyber
- Legal name
- Hedgehog Security Ltd
- Website
- https://hedgehogsecurity.co.uk
- Company type
- Private
- Founded year
- 2009
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Hedgehog Security is a UK-based offensive cybersecurity firm founded in 2009, delivering manual penetration testing and Cyber Essentials certification to enterprise and SMB clients across financial services, healthcare, government contractors, and regulated industries.
- Ownership category
- akta.pro rank
Hedgehog Cyber industry classification
Industry- Product category
- Cybersecurity Penetration Testing Services
- NAICS
- Investigation and Security Services (5616), Security Systems Services (56162)
- SIC
- Services-Testing Laboratories (8734)
- akta.pro primary industry
- Vulnerability Assessment, Security Audits & Compliance Testing (BPAKAHAG)
- akta.pro secondary industries
- Vulnerability Management & Penetration Testing Services (BPAEADAD), Cyber Defense & Information Security (National Security) (BPAIAHAE)
Keywords
Where Hedgehog Cyber is headquartered
LocationHeadquarters
- HQ city
- Gibraltar
- HQ country
- Gibraltar
Offices1 record
Markets served
Hedgehog Cyber business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Penetration Testing Services: Manual, human-led penetration testing engagements covering external/internal infrastructure, web applications, mobile applications, cloud configuration reviews, social engineering, wireless, and red team operations. Pricing is fixed-price based on scope following free scoping call. Every engagement includes free retest of all findings included in original price. Duration ranges from 3-5 days for focused web application tests to 5-10+ days for comprehensive infrastructure assessments.
- Cyber Essentials Certification: End-to-end Cyber Essentials (CE) and Cyber Essentials Plus (CE+) certification services. CE is self-assessment questionnaire with assessor guidance; CE+ adds hands-on technical audit. Includes gap analysis, remediation support, and annual renewal guidance. Pricing bundled into single engagement for clients pursuing both levels.
- Vulnerability Scanning: Automated vulnerability scanning services for continuous monitoring of external attack surface. Complements manual penetration testing for ongoing vulnerability management between deeper assessments.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| One time/ perpetual license | Pay-as-you-go | Web Application Penetration Testing - starts from a few thousand pounds |
| One time/ perpetual license | Pay-as-you-go | Comprehensive Infrastructure Testing - higher price point |
| One time/ perpetual license | Pay-as-you-go | Cyber Essentials Self-Assessment (CE) |
| One time/ perpetual license | Pay-as-you-go | Cyber Essentials Plus (CE+) Technical Audit |
Go-to-market motion3 records
Distribution channels3 records
Marketing channels5 records
Hedgehog Cyber product offering
Product offeringCore offering
Hedgehog Security delivers CREST-certified penetration testing and Cyber Essentials certification services to UK organisations. The company conducts manual, human-led simulated cyber attacks against external and internal infrastructure, web and mobile applications, APIs, cloud environments, wireless networks, and people. It also provides end-to-end UK Government baseline Cyber Essentials (CE) and Cyber Essentials Plus (CE+) certification, including gap analysis, remediation guidance, and annual renewals.
Product overview
Hedgehog Security is a specialist offensive security firm offering two core service lines — Penetration Testing and Cyber Essentials Certification — backed by a portfolio of specialist sub-services. The Penetration Testing umbrella covers external/internal infrastructure, web application, API, mobile application, network, wireless/airspace, UAV/drone, and cloud configuration testing, plus red team engagements. The Cyber Essentials service covers both the self-assessment (CE) and technical audit (CE+) routes, supported by a Concierge guidance option. Complementary services include vulnerability scanning, PCI-DSS penetration testing, RTS (Gambling Commission) testing, and Windows build reviews. The firm also resells or refers a related managed SOC service (SOCinaBox). The company is part of the UK Cyber Defence group and holds CREST, MoD, IASME, and CHECK accreditations.
Differentiator
Problem solved
Functional benefit
Products and services
- Penetration Testing Authorised simulated cyber attacks conducted by CREST-certified testers against external/internal infrastructure, web applications, mobile applications, cloud environments, wireless networks, and via social engineering. Delivered with manual exploitation, attack chain analysis, and business-contextualised reporting with CVSS ratings. Targeted at UK organisations needing third-party security validation.
- Cyber Essentials Certification UK Government baseline security certification delivered end-to-end, covering the self-assessment route (Cyber Essentials) and the hands-on technical audit (Cyber Essentials Plus). Includes gap analysis, remediation guidance, and annual renewal support. Targeted at UK organisations pursuing certification for government or enterprise contracts.
- CE Concierge Fully guided white-glove Cyber Essentials certification journey handling every step from initial gap analysis and remediation through to completed certification. Targeted at organisations that want minimal disruption to their business during certification.
- Red Team Engagements Multi-surface adversary simulation testing people, processes, and technology simultaneously to provide a realistic picture of how an attacker would compromise an organisation. Targeted at organisations seeking the most realistic offensive security validation.
- Vulnerability Scanning Automated scanning of external attack surface to identify known vulnerabilities, missing patches, misconfigurations, and compliance gaps on a continuous or one-off basis. Complements manual penetration testing for ongoing vulnerability management.
- Cloud Configuration Review Configuration review of AWS, Azure, and GCP environments against CIS Benchmarks, assessing IAM policies, storage permissions, network segmentation, serverless functions, and container security. Targeted at organisations operating cloud infrastructure.
- PCI-DSS Penetration Testing Penetration testing of cardholder data environments meeting PCI DSS Requirement 11.3, conducted by CREST-certified testers. Targeted at merchants and payment processors needing PCI DSS compliance validation.
- RTS (Gambling Commission) Testing Security testing aligned with the Gambling Commission's Remote Technical Standards (RTS), ensuring compliance for UK-licensed gambling operators.
Quantifiable outcome
- Fix deployed within 24 hours of critical authentication bypass discovery
- +3 more outcomes
Companies that use Hedgehog Cyber
Customer profileNamed customers5 records
Segments5 records
Ideal customer profiles3 records
Hedgehog Cyber technology and API
TechnologyTechnology focussed No
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature3 records
Hedgehog Cyber partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- UK Cyber DefencecoreUK Cyber Defence is the parent group of Hedgehog Security. Hedgehog Security is the offensive security and Cyber Essentials arm of the group. The group comprises specialist cyber security companies providing offensive security, managed SOC services, and cyber defence solutions across the United Kingdom.
Scale indicators4 records
Recent moves6 records
Expansion highlights6 records
Hedgehog Cyber competitors and assessment
Company assessmentDirect peers
- Bishop Fox: US-based offensive security firm specialising in penetration testing, red team, and attack surface management with a boutique, expert-driven delivery model analogous to Hedgehog's positioning despite different geography.
- MDSec: UK penetration testing boutique known for application security research and offensive expertise; closely aligned with Hedgehog in technical depth, UK base, and customer segment.
- Secarma: UK penetration testing and cybersecurity consultancy offering CREST-accredited web application, infrastructure, and cloud testing; closely comparable in UK-domestic focus, accreditation profile, and target mid-market/enterprise customers.
- Pen Test Partners: UK-based penetration testing boutique offering CREST-accredited web, infrastructure, mobile, and red team services with similar customer mix across financial services and enterprise; most direct comparable in size, geography, and service scope.
- Cyberis: UK-based cyber security consultancy delivering penetration testing, red team, and threat-led services with CREST and CHECK accreditations; comparable in service portfolio, methodology emphasis, and UK enterprise/government target market.
- Triskele Labs: UK-headquartered offensive security firm providing penetration testing, red team operations, and CREST-accredited assurance services; similar boutique scale and service-focused model to Hedgehog.
Broad incumbents
- NCC Group: Large UK-listed cyber security and resilience firm with extensive penetration testing, CHECK, and CREST capabilities serving enterprise and government; represents the scaled incumbent against which boutiques like Hedgehog compete.
- WithSecure (formerly F-Secure Cyber Security Consulting): European-headquartered cyber security vendor with a dedicated offensive security consulting practice delivering penetration testing and red team services to enterprise customers; comparable for offensive-services execution quality at greater scale.
- Context Information Security: European technical security consultancy (now part of Accenture Security) delivering penetration testing, red team, and CHECK-accredited services to enterprise and government; relevant for understanding how scaled consultancies compete in the same UK/CE regulatory market.
- Mandiant (Google Cloud): Global incident response and offensive security consultancy offering enterprise-grade penetration testing and red team services; sets the upper benchmark on engagement scope and pricing for advanced engagements.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks6 records
Key highlights6 records
Customer concentration
Hedgehog Cyber social profiles
Digital presenceHedgehog Cyber compliance and trust
Trust signalCompliance7 records
Hedgehog Cyber financial estimates
Financial estimateRevenue estimate
Valuation estimate
Hedgehog Cyber leadership team
Management profileNumber of profiles
Profiles6 records
Hedgehog Cyber funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Hedgehog Cyber M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Hedgehog Cyber
What does Hedgehog Cyber do?
Hedgehog Security delivers CREST-certified penetration testing and Cyber Essentials certification services to UK organisations. The company conducts manual, human-led simulated cyber attacks against external and internal infrastructure, web and mobile applications, APIs, cloud environments, wireless networks, and people. It also provides end-to-end UK Government baseline Cyber Essentials (CE) and Cyber Essentials Plus (CE+) certification, including gap analysis, remediation guidance, and annual renewals.
Is Hedgehog Cyber a public or private company?
Hedgehog Cyber is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Hedgehog Cyber founded?
Hedgehog Cyber was founded in 2009. It employs 11 to 50 people.
Where is Hedgehog Cyber based?
Hedgehog Cyber is headquartered in Gibraltar, Gibraltar.
How does Hedgehog Cyber make money?
Three revenue lines are on record. Penetration Testing Services are the primary driver. The others are cyber Essentials Certification and vulnerability Scanning.
Who are Hedgehog Cyber's main competitors?
Direct peers on record are Bishop Fox, MDSec, Secarma, Pen Test Partners, Cyberis and Triskele Labs. Broad incumbents are NCC Group, WithSecure (formerly F-Secure Cyber Security Consulting), Context Information Security and Mandiant (Google Cloud).
Does Hedgehog Cyber have an API?
No public API is recorded for Hedgehog Cyber.
What industry is Hedgehog Cyber in?
Hedgehog Cyber's product category is Cybersecurity Penetration Testing Services. Its primary akta.pro industry code is BPAKAHAG, Vulnerability Assessment, Security Audits & Compliance Testing, with a secondary code of BPAEADAD, Vulnerability Management & Penetration Testing Services. Its NAICS code is 5616 and its SIC code is 8734.