How an engagement works
The short version
We agree on exactly what we’ll test, when, and how, in writing, before we touch anything. We test only inside that agreement. We stop if something looks wrong. We report what we found in plain language, then delete your data when the retention period ends.
1. Scoping call
About 30 minutes. We ask what prompted the call (a questionnaire, a flow-down, an insurance renewal, a gut feeling), what you have, and what you’re worried about. If we’re not the right fit, we’ll say so.
2. Proposal and authorization
You get a written proposal with a fixed scope, a fixed price, and dates. Before any testing, we need two signed documents:
- An agreement covering scope, price, confidentiality, and liability.
- Written authorization and rules of engagement listing exactly which assets we may test, the testing window, what techniques are allowed, who to call, and anything that’s off limits.
If an asset is hosted by someone else (a cloud provider, an MSP, a web host), we confirm you have the right to authorize testing, and get that host’s permission where their terms require it.
3. The testing window
We test only during the agreed window, only against the listed assets, and only with the agreed techniques. Your technical contact can reach us the whole time.
When we stop work
We pause testing and call your contact right away if:
- Something we’re testing slows down, errors, or looks unstable
- We find signs that someone else is already in your environment
- We come across data that’s clearly outside the scope, like personal health records or another company’s systems
- You ask us to stop, for any reason
We resume only once you tell us to.
Urgent findings
If we find something serious and easy to exploit, like an exposed admin panel with a default password, we tell you the same day. We don’t wait for the report.
4. Report and walkthrough
Every finding includes what we saw, why it matters to your business, the evidence, and the steps to fix it, in priority order. The executive summary is written for owners and leadership; the technical section is written for whoever does the fixing. We walk through it with you on a call, and answer follow-up questions while you work on the fixes.
How we handle your data
- Collected only as needed. We collect only what the work requires. For breach data, we record counts, not passwords.
- Encrypted and access-limited. Engagement data is stored encrypted, and only the people working on your engagement can get to it.
- Deleted on schedule. By default, raw testing data is deleted 90 days after we deliver the report, unless your agreement sets a different period. We’ll confirm deletion in writing if you ask.
- Never shared. We don’t share your findings or name you as a client without written permission.
Start with a short call.
Tell us what prompted the question. We'll tell you whether we can help and what it would take.