Lybica Crucible
The proving fire.
Independent testing at the frequency you choose, with a person deciding what actually matters before you see it.
The problem
Your pipeline finding your own bugs is not independence.
Your own pipeline finding your own bugs is good engineering, and increasingly it happens automatically. Keep doing it. It is simply not the thing being asked for.
A customer's due-diligence team, a prime's assurance questionnaire and an assessor all want the same two properties: testing that did not come from the people who wrote the code — and more often than once a year.
How it works.
Scope agreed once, then a cycle that repeats for as long as the service runs.
-
Scope, once
We agree what a target is, what is in and out of bounds, and who to call if something breaks. Then it stays agreed.
-
Test, at your cadence
Nightly, weekly, fortnightly or monthly — whichever matches the pace at which your systems actually change.
-
Validate, not just scan
AI-driven validation attempts safe exploitation to establish what is genuinely exploitable rather than theoretical.
-
A person decides
A named reviewer decides what is real, and the report is written for whoever asked for it — your engineers, or your customer's security team.
Why frequency matters
An annual test describes one day.
An assurance questionnaire asks about your current state. A test from eleven months ago answers a question nobody asked. Test continuously and the answer is always current — and remediation becomes a steady trickle your engineers absorb, instead of an annual emergency that arrives the week before a renewal.
What you get.
- A report you can hand straight to a customer, a prime or an assessor — written to be read by them, not just by you.
- A tracked remediation position, so the question “what did you do about it?” has an answer with dates on it.
- Evidence of the vulnerability management and security testing controls your framework requires, produced as a by-product of the work.
Honest scope
Where this is not the right answer.
Some contracts specifically require CREST-accredited or CHECK-scheme testing. Crucible is not either of those, and it does not substitute for them. If your contract says CREST or CHECK, we will tell you so plainly on the first call and help you scope the engagement you actually need — then keep Crucible running around it, because an accredited test once a year still only describes one day.
Pricing
Crucible starts at the Proof tier.
£900 a month plus VAT, on an annual term billed monthly, with one target reported monthly — and Atlas included. The Standing Defence tier moves the same target to fortnightly reporting and adds Vigil.