[ How we test ]
AI does the searching. People do the thinking.
[ 01 / The division of labour ]
What the machine does, and what it does not.
Automation removed roughly the first two days of every engagement. It did not remove the reason you hire a penetration tester, which is judgement about what is worth chasing.
Automated
Recon, enumeration, triage
- Asset discovery and subdomain enumeration
- Port, service and version fingerprinting
- Known-CVE matching against identified versions
- Crawling, parameter discovery and endpoint mapping
- First-pass triage and false-positive removal
- Regression checks against previously closed findings
Human, always
Exploitation, chaining, judgement
- Deciding which of the findings actually matter here
- Business logic abuse, the flaws no signature describes
- Chaining low findings into one that reaches your data
- Access control testing across real role boundaries
- Judging exploitability in your specific configuration
- Writing the report, and standing behind every word in it
The practical effect: an engagement that used to take ten days now takes six or seven, and more of those days are spent on the half of the work that finds the interesting things. That is where the pricing comes from.
[ 02 / How we report ]
Four rules the report has to pass before it leaves.
- 01
A finding without a proof is a guess
If we cannot demonstrate it, it does not go in the report as a finding. It goes in observations, clearly marked, where it belongs.
- 02
Severity is about your business, not the CVSS calculator
We score with CVSS v4.0 because auditors expect it, then tell you plainly which three findings we would fix first if this were our company.
- 03
You should be able to reproduce everything
Every finding carries the exact steps, requests and payloads. If your engineer cannot reproduce it from the report alone, we wrote it badly.
- 04
We tell you when you are buying the wrong test
Sometimes the honest answer is a smaller scope, a different engagement, or that you should fix your patching process before paying anyone to test it.
[ 03 / The testers ]
Certifications you can verify, on people you can name.
We do not staff engagements with junior testers running a script. You are told who is assigned before the test starts, and you can talk to them while it runs.
- CREST CRTRegistered Penetration Tester
- OSCPOffensive Security Certified Professional
- OSWEOffensive Security Web Expert
- BSCPBurp Suite Certified Practitioner
- CRTOCertified Red Team Operator
- CRTPCertified Red Team Professional
Methodologies and standards
[ 04 / Rules of engagement ]
What we will not do.
Written into every engagement letter, before anyone touches a target.
- 01No denial-of-service testing unless you ask for it in writing, against a named target, in an agreed window.
- 02No testing outside the agreed scope, even when something interesting is one hop away. We report the path and ask.
- 03No destructive actions. We prove access rather than exercising it, and we do not modify or delete your data.
- 04No social engineering of your staff without explicit written authorisation naming the techniques permitted.
- 05No third-party systems, ever, without their own signed authorisation, including your cloud provider's shared components.
- 06No sharing your findings with anyone, in any form, including anonymised marketing statistics.
Ask us something a brochure cannot answer.
Bring your hardest scoping question to the call. You will be talking to somebody who has run the engagement, not somebody reading from a sheet.