Global · CREST · STAR · CBEST

CREST accredited penetration testing, delivered by Sumrite end to end.

Banks, regulators and large buyers often ask for a CREST accredited test. Sumrite scopes and runs it with your team, and the testing and report come through a CREST member company in the Sumrite partner network.

Get a quoteAll accredited testing
CREST member partnerFormal CREST work is carried out and issued through a CREST accredited partner company.
Certified testersTesting led by CREST certified testers where the scheme requires it.
One teamScoping, coordination, fixes and retest stay with Sumrite.

CREST is an international not-for-profit body that accredits penetration testing companies and certifies individual testers, with chapters across the UK, Europe, the Americas, Asia, Australia and New Zealand and the Middle East. A CREST accredited penetration test is one carried out by a CREST member company with CREST certified staff. Sumrite delivers it end to end, with the accredited work issued through a CREST member partner.

Who needs it

WhoWhen it applies
Banks and financial servicesRegulators and internal policy ask for CREST or for CREST STAR and CBEST style intelligence-led testing
UK public sectorCREST is one of the accepted routes for PSN IT Health Checks
Enterprise vendor reviewsSecurity questionnaires that ask whether the tester is CREST accredited
Tenders worldwideBids in the UK, Gulf, Asia and Australia that name CREST as a requirement

How Sumrite delivers it

Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.

  1. Confirm the scheme. CREST penetration testing, STAR or CBEST style intelligence-led testing, or a buyer simply asking for a CREST accredited firm.
  2. Scope and NDA. Assets, rules of engagement and reporting format agreed before any credentials are shared.
  3. Testing by CREST certified testers. Carried out by the CREST member partner with Sumrite coordinating and running remediation support.
  4. Report and retest. The report is issued by the CREST member company; fixes are retested and the record updated.
IndiaCERT-In empanelled auditGovernment systems and websites, SEBI regulated entities, tenders that name CERT-InSaudi ArabiaNCA licensed testingGovernment entities, critical national infrastructure and their suppliersUAEDubai Cyber Force testingDubai government entities and their suppliers

Frequently asked questions

Is Sumrite a CREST member?

Sumrite delivers CREST accredited testing through a CREST member company in its partner network. The formal testing and report come from that accredited company, while Sumrite runs the engagement end to end.

What is the difference between CREST accredited and CREST certified?

Companies are accredited by CREST; individual testers are certified, for example as CREST Registered or Certified Testers. Accredited companies must employ certified staff.

Do SOC 2 or ISO 27001 require a CREST test?

No. They require an independent, competent test. CREST matters when a regulator, buyer or tender names it.

Accredited testing

All schemes and regionsCERT-In empanelled audit (India)NCA licensed testing (Saudi Arabia)Dubai Cyber Force testing (UAE)

Need a test a regulator or buyer will accept?

Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.

Get a Quote