Approach
Methodology
We combine a rigorous methodological approach with a deep understanding of threat intelligence. Our process is designed to be predictable for you and uncomfortable for attackers.
Engagement lifecycle
Five phases, no surprises
- 01
Scope
We start with a conversation about your goals, environment and constraints, then propose a scope and effort estimate. No templated quotes.
- 02
Plan
We agree rules of engagement, testing windows, points of contact and safety measures in writing before any testing starts.
- 03
Test
Hands-on, manual testing guided by public methodologies and adversary thinking. Critical issues are reported immediately, not at the end.
- 04
Report
A clear report with an executive summary, reproducible technical findings and prioritised remediation, followed by a walkthrough call.
- 05
Retest
Once you've fixed the issues, we verify the fixes and update the report so you have a clear record of closure.
Principles
What you can expect from us
Manual first
Tools help us cover ground; people find the issues that matter. Every finding is verified by hand.
Safe by design
We treat your production systems with care: agreed windows, conservative techniques, and a stop-the-test channel at all times.
Plain language
Findings are written so engineers can fix them and leadership can understand the risk, without jargon for its own sake.
Confidential by default
Engagement data is shared only with those who need it, handled under a written agreement, and securely deleted when the engagement ends.
Responsible disclosure
When we find vulnerabilities in third-party products, we follow coordinated disclosure and work with vendors before publishing.
No surprises
Clear scope, clear pricing and regular updates. If something changes during testing, you hear about it first.
Reference frameworks
Grounded in public methodology
We draw on widely recognised, openly published testing guides and frameworks, so our coverage is transparent and our findings map to language your teams already use.
- OWASP WSTG
- OWASP ASVS
- OWASP MASVS
- PTES
- NIST SP 800-115
- MITRE ATT&CK
- CIS Benchmarks
- ETSI EN 303 645
- IEC 81001-5-1
- IEC 62443
Common questions
Let's talk about what you need to protect.
Tell us a little about your environment and goals. We'll reply with questions, a suggested scope, or an honest note if we're not the right fit.