How an engagement starts
No online checkout. No automated pentest. No customer portal to configure. Just a straightforward process from enquiry to results.
Request
You submit a short form describing your organization and objectives. This does not authorize any testing.
Scope
A short conversation to understand your environment, concerns, and objectives, and agree an appropriate scope: what's included, what's excluded, and how deep to go.
Proposal
You receive a straightforward, itemized proposal: objective, scope, exclusions, methodology, deliverables, timing, price and assumptions. No surprises.
Authorize
We agree written scope, authorization and Rules of Engagement, covering the authorized organization, target scope, exclusions, testing window, allowed and prohibited techniques, emergency contact, data handling and confidentiality. Testing never starts before this is signed.
Assess
Discovery, analysis, human validation, and, where authorized, attack-path investigation, carried out against the agreed scope and timeline.
Report
You receive the full report: executive summary, asset overview, validated findings with evidence, attack paths if identified, prioritized remediation, and assessment limitations.
Review
A live debrief call with the person who did the work, to walk through findings, answer questions, and discuss remediation priorities.
Process questions
How fast can we actually start?
The request form and initial scoping call typically happen within a day or two of submission. The gap between "authorize" and a finished report is usually the longer part, see the assessment duration answer on our FAQ page, not the gap between enquiry and getting started.
What do we need to prepare before the scoping call?
Nothing formal. It helps to know your organization's known domains and brands, and to have a rough sense of what you're trying to learn (a general check, or something specific like a recent acquisition or a new public-facing product). We build the rest of the picture ourselves during discovery.
Can scope change after the engagement starts?
Yes, but only through the same written process used to set it initially. If discovery surfaces something clearly outside the original scope, we flag it and agree an amendment before investigating further, we don't silently expand testing.
Who actually does the work?
The same person who signs the Rules of Engagement and joins the scoping call is involved in the assessment itself, and leads the review call at the end. You are not handed off to an anonymous delivery team partway through.
What happens after the review call?
You keep the full report and are free to act on it independently. If remediation raises new questions, or you want a follow-up check once fixes are in place, that's a short conversation, not a new sales process.
Start with a no-obligation request
We review your environment and objectives, agree an appropriate scope, and provide a straightforward proposal.