See exactly how we test.
A repeatable, human-led process aligned to recognized standards — with a QA gate and evidence behind every reported issue.
Scope & threat model
We map your environment, agree targets and rules of engagement, and model the threats that matter.
Recon & mapping
Attack-surface discovery and enumeration — kept current as your systems change.
Manual exploitation
Certified testers exploit by hand, chaining auth, access-control, and business-logic flaws.
Evidence & QA gate
Findings ship with supporting evidence and pass an internal QA review before you see them.
Report & guidance
Risk-ranked findings with clear, actionable remediation mapped to each issue.
Retests
Retests are requested and tracked in the platform under the terms agreed in your engagement.
Every finding is QA-reviewed before release.
Reports are checked against a checklist before you see them:
- Scope matches what was agreed
- CVSS vector and score are accurate
- Evidence supports the finding
- Remediation guidance is specific and actionable
- Formatting and classification are correct
Scored with CVSS v3.1, explained in context.
Each finding carries a CVSS v3.1 vector and base score. Where business context changes how serious an issue is, the report states the severity we assign and why.
| Severity | CVSS v3.1 base score |
|---|---|
| Critical | 9.0 – 10.0 |
| High | 7.0 – 8.9 |
| Medium | 4.0 – 6.9 |
| Low | 0.1 – 3.9 |
| Informational | 0.0 |
Testing that is controlled and communicated.
Agreed rules of engagement
Targets, exclusions, permitted techniques and testing windows are agreed before work begins.
Safe techniques, coordinated
We use safe techniques and coordinate with you before any potentially disruptive test.
Evidence stays with the finding
Evidence and reproduction steps are stored with each finding in the platform, with a SHA-256 hash recorded.
Contacts agreed up front
Engagement contacts and communication arrangements are confirmed during scoping.
Urgent issues
Before testing starts, we agree who hears about a critical issue and how, so urgent problems reach your team during testing rather than waiting for the report.
Release after QA
Findings are released to you after QA when the engagement is delivered. Remediation, retest requests and reports are then managed in the platform.
Recognized standards, not guesswork.
Prove what an attacker could actually do.
A short scoping call, no obligation.