How we work
How we test
and report.
An assessment should leave you better equipped to decide what comes next.
We start with the decisions you need to make and the systems they depend on. Our testers lead the investigation, using hands-on work and AI assistance to explore weaknesses and evaluate the evidence. We explain the results in terms your technical team and decision-makers can use.
01 / Direct contact
Talk directly
about the work.
You can discuss the scope, results or a particular finding directly with the person doing the testing. We work with you to understand what you need from the assessment and explain the results.
That matters most when a recommendation has to fit how you actually run the system, or when you are deciding what to fix first. We explain the evidence and the trade-offs; the priorities remain yours.
02 / The engagement
From first conversation
to final report.
We agree what to test before starting, stay within those boundaries during testing and report what we found.
Before: agree the scope and permissions
We discuss your objectives, the target systems, who owns them and what access is available. We agree testing windows, exclusions, permitted techniques and an operational contact, and confirm authorization, including any necessary third-party permissions, before testing starts.
We also identify sensitive data and actions that could affect availability, and build those limits into the testing plan rather than discovering them mid-test.
During: test and gather evidence
We combine tool-assisted discovery with manual testing, follow the leads that matter, check whether weaknesses can be reproduced and record the evidence. If a next step could cause disruption or goes beyond what was agreed, we stop and ask before taking it.
Results are interpreted in context: what access they require, which systems they affect and how those systems are used. If restrictions limit what we can validate, the report says so.
After: explain the findings
The report sets out what we tested, what we found and the limits of the assessment. Each finding explains the issue, its impact, the evidence and what to do about it, written for both technical and business readers.
The recommendations point to a practical fix and take account of how the system is run and who maintains it, rather than assuming every change is easy or urgent.
03 / AI-assisted testing
How AI fits
into the work.
The tester sets the direction: what matters to your business, which assumptions to challenge and what to investigate next. AI helps execute that work and analyze the results alongside hands-on testing. The tester examines what comes back, follows up on gaps or unexpected behavior and directs the next round of investigation. It is an ongoing exchange, guided by human experience and judgment.
Checking the findings
We check apparent weaknesses against the evidence and the system's behavior, and judge how much each one matters in your environment. The report separates what we observed from what is plausible but not shown.
Thorough testing for smaller organizations
Using AI for execution and analysis helps our testers spend more of their time understanding your systems, pursuing important leads and weighing the risks. That efficiency can make a thorough assessment more accessible to smaller organizations, with the findings explained in the context of their business.
04 / Reporting
What we found
and what to do about it.
A useful report helps you explain the risk, agree priorities and plan the work.
Decision-makers get an explanation of why a finding matters; the people responsible for fixing it get evidence and practical recommendations. Each finding identifies the affected systems and includes reproduction details where testing allowed. The report also records the scope and limitations, so you know what the conclusions are based on.
A severity rating is a starting point, not the whole decision. We explain what a weakness could allow, the access it needs and the controls that affect its impact. That context helps you weigh the risk against the effort of a fix and explain the priority to others.
Talk through what you need05 / Assessment limits
What the result
can and cannot tell you.
An assessment examines agreed systems at a point in time. It cannot guarantee that every weakness has been found; access restrictions, excluded techniques and later changes to the systems all affect what we can establish.
The report records those limits. It is not compliance certification or continuous monitoring, and it covers verification of fixes only where retesting was agreed and done.
Discuss an assessment