Approach
Careful, methodical, and on the record.
Good security testing is less about clever tricks than about discipline: knowing exactly what you're allowed to touch, covering it systematically, and proving every claim you make.
Manual first
Tools give us coverage; people give us judgement. Automated scanning narrows the search, then every candidate issue is examined by hand. Nothing reaches your report on a tool's say-so.
Every finding reproduced
If we can't show it, we don't report it. Each finding includes the evidence and steps your team needs to confirm it independently.
No completeness claims
A test is a time-boxed sample, not a guarantee: we can't promise to find vulnerabilities, or that none remain afterwards. Reports state precisely what was in scope, what wasn't, and the limits of what was possible in the time available.
Severity you can defend
CVSS v4.0 scores, adjusted with written reasoning for your context. A high is a high because of what it allows, not because a tool said so.
Critical issues, same day
If we find something serious mid-test, you hear about it through your agreed contact that day, not two weeks later in a PDF.
Least data necessary
We demonstrate impact with the minimum data needed and with our own test accounts wherever possible. We never keep copies of your users' data.
Engagement lifecycle
Seven stages, all visible in your portal.
The Engagements view in the client portal shows which stage you're in, who's leading the work, the testing window and the findings as they're confirmed.
Go to the client portal- Scoping
We learn what the system does and what you need to prove. You get a written scope, a test plan and a fixed-fee proposal.
- Scheduled
Contract and rules of engagement signed, test accounts and environments ready, dates locked, contacts confirmed on both sides.
- Testing
Active testing inside the agreed window and targets only. Critical findings are escalated as soon as they're confirmed.
- Reporting
Findings written up, evidence attached, severity reviewed by a second tester before anything is delivered.
- Delivered
Report and executive summary published to your Report Vault, followed by a readout call with your engineers.
- Retesting
You fix; we verify. Each finding is marked fixed, partially fixed or open, with fresh evidence.
- Closed
Retest report and attestation letter issued. Test data and any source code are deleted under the retention policy.
Rules of engagement
Nothing happens without written authorisation.
Before any testing starts, both sides sign a document that defines exactly what we may and may not do. It protects you, it protects us, and it's non-negotiable.
Named targets only
Specific hostnames, IP ranges, applications and API versions. Anything not listed is out of scope, including third-party services you rely on.
Agreed windows
Testing happens inside the hours you set, from source addresses we give you in advance so your team can tell us apart from real traffic.
No disruption by default
No denial-of-service, load or destructive testing, and no social engineering, unless explicitly added to the scope in writing.
Test accounts
We work from accounts you create for us, at each role you want tested. We don't use real customers' accounts.
Emergency stop
A named contact on each side who can halt testing immediately, at any hour, for any reason.
Data handling
Evidence is stored encrypted, shared only through the portal, and deleted on the schedule agreed in the contract.
Severity
What each rating means.
Based on CVSS v4.0 and adjusted for your context. Fix timelines are our recommendation; your own policy takes precedence.
| Rating | What it usually means | Suggested fix time |
|---|---|---|
| Critical | Remote compromise of the system or of many users' data with little or no precondition. | Immediately, typically within 7 days |
| High | Significant data exposure or privilege gain that needs only an ordinary account or a small precondition. | Within 30 days |
| Medium | Real but constrained impact: needs user interaction, a specific configuration or chaining with another issue. | Within 90 days |
| Low | Limited impact on its own; hardening that reduces the blast radius of other issues. | Next planned release |
| Informational | Observations and best-practice notes with no direct exploitable impact. | At your discretion |
Standards
References your auditors will recognise.
- OWASP WSTGWeb Security Testing Guide: the test-case backbone for web applications.
- OWASP ASVSApplication Security Verification Standard: the control set for audits and code review.
- OWASP API Security Top 10The risk categories every API test covers.
- CVSS v4.0Severity scoring, with contextual adjustment documented in each finding.
- PTES & NIST SP 800-115Engagement structure: pre-engagement, testing, reporting.
- CIS BenchmarksConfiguration baselines for cloud accounts and infrastructure.
The report
What's inside every report.
- Executive summaryOverall posture, the issues that matter most and what to do first, in two pages.
- Scope, method & limitationsExactly what was tested, when, from where, with which accounts, and what wasn't covered.
- FindingsEach with severity and CVSS vector, affected components, description, impact, reproduction steps, evidence, remediation and references.
- Positive observationsControls that held up, so you know what not to break.
- AppendicesTest accounts used, source addresses, tooling and a findings summary table.