Methodology
Security testing is a controlled intrusion into your business. This is how we keep it controlled, repeatable and useful.
Rules of engagement
No testing starts without a signed SOW and rules of engagement naming the systems, the windows and who can authorize changes.
Systems you can't risk (production databases, safety systems, third-party assets you don't own) are excluded in writing.
A named contact on each side who can halt testing at any time, for any reason.
An exploitable critical finding is reported to your named contact when it is confirmed, not held for the final report.
Denial of service, data destruction and persistence beyond the engagement are excluded unless you authorize them explicitly.
Accounts, implants and artefacts created during testing are removed and listed in the report.
Standards
Every engagement is planned against a public standard, so your auditors, insurers and customers can see what was tested and how.
Process
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Your data
We prove access without bulk-copying your data. Evidence is redacted to what the finding needs.
Findings, evidence and reports are stored encrypted and delivered through the client portal.
Every engagement is covered by the confidentiality terms of the Master Services Agreement.
CWE-22 · ATT&CK T1190
Impact
Session tokens for active users can be read remotely, giving an authenticated foothold on the internal network without credentials.
Evidence
$ curl -sk https://vpn.target/…/../../session
HTTP/1.1 200 OK
session=9f2c…e71a user=j.doe ✓ validRemediation
Apply the vendor patch, invalidate all active sessions, and restrict the management interface to the admin network.
Research
ciso-strategy · Sep 24, 2026
Thirty-three cybersecurity M&A deals in August 2026, led by Brinqa-PlexTrac and Cribl-Radiant Security, show exposure management and SOC platforms swallowing offensive-security and AI-native automation tools.
ciso-strategy · Sep 18, 2026
SE Labs launched PIVOT, a six-month, full-attack-chain testing program backed by Broadcom, CrowdStrike, Fortinet, Palo Alto Networks and Sophos, with results due in early 2027.
ai-security · Aug 30, 2026
GPT-5.6-Cyber completes 95% of advanced offensive security requests that OpenAI's flagship refuses 98.5% of the time. That headline number measures compliance, not competence — and on OpenAI's own vulnerability reporting benchmark the specialized model is worse than the one it replaces. The security control that remains is an allowlist, and the first public data point on how well that scales went the wrong direction.
Start an engagement