Methodology
The same senior tester from scoping through retest, and a report your engineers can act on.
Inquiry and scoping
You describe the target — product type, environments, roles, and any compliance window. We reply within 1 business day with clarifying questions or a proposed approach. No sales layer in between.
Scoping covers in-scope surfaces, out-of-scope constraints, test accounts and roles, data handling expectations, and communication channels for critical findings.
Proposal and statement of work
Once scope is clear, you receive a written statement of work: objectives, methodology references (e.g. OWASP WSTG / MASVS / API Top 10 as applicable), timeline, deliverables, and commercial terms. Work starts after written acceptance and kickoff scheduling.
Kickoff and access
Kickoff confirms environments, credentials, VPN or IP allowlisting, emergency contacts, and the escalation path for high-severity issues. Testing does not begin until access and rules of engagement are confirmed.
Testing
Manual, authenticated testing against the agreed surface. Automation may support coverage; findings are validated by hand. Critical issues are raised during the engagement when impact warrants immediate notice — not held until the final PDF.
Draft report
You receive a draft with an executive summary, methodology notes, findings (severity, reproduction steps, evidence, remediation guidance), and an inventory of tested surfaces. Severity is consistent across the report so engineering can prioritize.
Prefer to see the format first? Request the sample report.
Debrief
A live walkthrough of findings with your engineering and security stakeholders — questions answered in the same session when possible. Clarifications from the debrief land in the final report.
Remediation window and retest
After fixes land, a focused retest validates addressed findings within the agreed window (free retest within 30 days). Retest results update finding status in the final deliverable.
Final delivery
The final report is the audit-ready artifact: dates, methodology, evidence, remediation status after retest, and contact for follow-up questions. Language of delivery is English or Spanish — your choice for the engagement.