Methodology
How we run every engagement
A consistent, documented process built on OWASP, PTES and NIST guidance, so you know what happens, when, and what you'll receive.
Scoping & rules of engagement
We agree in writing on targets, exclusions, testing windows, accounts, emergency contacts and how data will be handled. Nothing starts until this is signed off.
Discovery & mapping
We map the attack surface in scope: features, user roles, endpoints and integrations. Anything relevant we find outside the agreed scope is flagged to you before we touch it.
Assessment
Automated tools give us breadth. Certified testers then work by hand on authentication, access control, business logic and configuration, which is where serious issues usually hide.
Validation
Every finding is confirmed and its real-world impact demonstrated safely. We don't report theoretical issues as confirmed ones.
Reporting & debrief
You receive the full report and a walkthrough call with your team, so developers can ask questions directly.
Retest & attestation
Once fixes are in, we retest each finding and issue an updated report and attestation letter.
Severity ratings
How we rate findings
We start from CVSS and adjust for your business context. An issue on an internal test system rarely carries the same risk as one on your payment page.
| Severity | What it means | Suggested fix window |
|---|---|---|
| Critical | Direct, easy path to serious data exposure or system compromise. | Immediately. We notify you the same day. |
| High | Significant impact, possibly needing some conditions to exploit. | Within 2 weeks |
| Medium | Limited impact, or harder to exploit. | Within 1–2 months |
| Low | Minor weakness or defence-in-depth improvement. | Next planned release |
| Info | Observation or good-practice suggestion with no direct risk. | At your discretion |
Safety & confidentiality
How we protect you during testing
Written authorisation
We only test systems you've authorised in writing, within the agreed scope and windows.
No disruption by design
We avoid any action that could degrade service, and we coordinate with you before anything sensitive.
Confidential by default
NDAs, encrypted storage for test data, restricted access, and deletion after the engagement.
Find out where you're exposed before an attacker does.
Tell us what you need tested. We'll reply within one business day with questions or a fixed quote.