Methodology
How we scope, test, and report
A transparent, repeatable process — so you know what will happen, what will be tested, and what you'll receive before an engagement starts.
Engagement phases
Phase 1: Scoping
We learn what you want assessed and why, then propose a written scope: targets, environments, user roles, test types, timing, exclusions, and points of contact. A good scope is specific enough that both sides know exactly what will and won't be tested.
Phase 2: Authorization
No testing starts without written authorization from someone entitled to give it — covering the systems in scope and, where relevant, their hosting. If a third party hosts or operates part of the target, we confirm their requirements before testing.
Phase 3: Mapping and preparation
We map the application, API, or codebase: functionality, roles, data flows, technologies, and trust boundaries. This is where we decide where manual effort will be most valuable.
Phase 4: Testing or review
Automated tooling supports coverage; manual work does the heavy lifting — probing authentication, access control, input handling, and business logic within the agreed scope. Testing stays inside the agreed limits and techniques.
Phase 5: Validation
Every potential issue is reproduced and confirmed before it is reported. Findings we cannot confirm are either excluded or clearly labelled with the limits of what we could verify.
Phase 6: Risk rating
Each finding is rated by its likely impact and how readily it could be exploited in your environment, so the most important issues stand out.
Phase 7: Reporting and walkthrough
You receive a written report and a walkthrough of the findings with your team, focused on what to fix first and how.
Phase 8: Retesting
Where retesting is part of the engagement, we verify that fixes are effective and update the report to reflect the result.
Rules of engagement
Security testing must be safe and controlled. These rules apply to every engagement and are written into the agreed scope.
- Testing is limited to the systems, environments, and techniques in the written scope.
- Testing windows, and any techniques to avoid (such as load-heavy tests in production), are agreed in advance.
- If we find a serious issue during testing, we tell your nominated contact promptly rather than waiting for the report.
- If testing appears to cause unexpected impact, we pause and contact you.
- Test accounts and test data are used wherever possible; access to real personal data is kept to the minimum needed to confirm an issue.
- Credentials and sensitive information are exchanged only through an agreed secure channel.
How findings are rated
Ratings reflect impact and exploitability in your context, not a generic score. Where you need ratings aligned to a specific scheme, we can agree that during scoping.
- Critical
- Severe impact, readily exploitable — for example, unauthorised access to other customers' data or full account takeover. Address immediately.
- High
- Significant impact or exposure that an attacker could realistically exploit. Address as a priority.
- Medium
- Meaningful weakness that requires specific conditions or has limited impact. Plan a fix.
- Low
- Minor issue or defence-in-depth improvement with limited direct impact.
- Informational
- Observations and good-practice recommendations that don't represent an exploitable weakness on their own.
What the report contains
Executive summary
Overall posture and key risks in plain language for decision-makers.
Scope and approach
What was tested, when, how, and any limitations.
Findings
Each issue with its risk rating, affected components, evidence, and reproduction steps.
Remediation guidance
Practical, prioritised fixes for each finding.
Principles behind the process
Clearly defined scope
Targets, test types, timing, and exclusions are agreed in writing before any testing begins.
Practical, manual methodology
Automated tools support the work; experienced manual testing finds the access-control and logic flaws scanners miss.
Validated, actionable findings
Each finding is confirmed and documented with evidence and steps to reproduce — not a raw scanner export.
Prioritised remediation guidance
Findings are rated by risk so your team knows what to fix first, with practical guidance on how.
Clear, professional communication
Plain-language summaries for decision-makers and technical detail for the engineers doing the fixes.
Confidential handling
Assessment information is treated as confidential and shared only with the contacts you nominate.
Planning a security assessment?
Tell us about your application, API, or software security requirements. We can discuss the appropriate scope and next steps.
What happens next
- 01We review your enquiry and reply by email
- 02An initial discussion about your application and goals
- 03A written scope — nothing is tested until it's agreed