How we work
How a Rudranetra engagement works.
A clear, predictable process from the first call to the attestation letter. You'll always know what's happening, what we need, and what comes next.
Engagement steps
Ten steps, no surprises.
Most engagements move from first call to report in a few weeks. We confirm the exact timeline in your proposal.
Scoping questionnaire
A short questionnaire and call to understand what you need tested, why, and by when.
Proposal
A fixed-fee proposal stating tester-days, timeline, scope and deliverables. No surprises later.
Contract and authorisation
NDA, contract and written authorisation to test, signed before any testing starts.
Kickoff
We confirm access, accounts, contacts, testing windows and how we’ll communicate.
Testing
Manual testing within the agreed scope and windows, with regular check-ins if you want them.
Critical-finding alerts
If we find something critical, we tell you straight away rather than waiting for the report.
Report
A clear report with an executive summary, findings, evidence and remediation guidance.
Walkthrough
A call to take your engineers and stakeholders through the findings and answer questions.
Retest
Once you’ve fixed the findings, we retest them and update the report with their status.
Attestation
An attestation letter you can share with auditors, customers and partners.
Scope and effort
What affects scope and effort.
We size every engagement in tester-days, based on what's in scope. These are the main factors.
- Number of applications and user roles
- Number of API endpoints
- Platforms in scope (iOS, Android or both)
- IP addresses and network segments
- Cloud accounts and subscriptions
- Number of environments
- Compliance mapping needs
- Retest scope
- Deadlines and testing windows
Preparation
What we need from you.
Having these ready before kickoff keeps testing on schedule. We'll tell you exactly which apply to your scope.
- Test accounts for each user role
- Environment URLs for everything in scope
- API documentation or Postman/OpenAPI collections
- Mobile builds (IPA/APK) for mobile testing
- VPN access or a jump host for internal tests
- A named technical contact during testing
- An agreed testing window
Rules of engagement
Safe, controlled and agreed in advance.
Written authorisation
We test only what you have authorised in writing, and only from agreed sources.
Agreed windows
Testing happens within the windows we agree, around your releases and busy periods.
No destructive testing without approval
Anything that could affect availability or data is cleared with you first.
Immediate stop on request
Ask us to pause or stop at any point and we will, straight away.
Engagement types
Test once, or build it into your calendar.
One-off pentest
A single, scoped test for an audit, a customer request or a launch.
Annual testing
A planned yearly test aligned to your audit cycle.
Release-based testing
Testing tied to major releases or significant changes.
Retainer
Ongoing testing capacity through the year. Ask us how it would work for you.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.