Request sample reportGet a quote
Get a quote Request sample report

Methodology

Manual-first. Standards-based. Evidence-driven.

Every engagement follows recognised standards, is led by people rather than scanners, and produces evidence for every finding we report.

Request a sample report Get a quote

Standards we follow

Recognised frameworks, applied with judgement.

Standards give every test a consistent baseline. Experience decides where to dig deeper.

StandardVersionHow we use it
OWASP Web Security Testing Guide (WSTG)v4.2Web application test cases
OWASP Top 102025Web risk categories for reporting
OWASP API Security Top 102023API risk categories and test focus
OWASP MASVS and MASTGMASVS v2Mobile security requirements and test cases
Penetration Testing Execution Standard (PTES)—Engagement structure for infrastructure tests
NIST SP 800-115—Technical security testing and assessment
CVSSv3.1Severity scoring for every finding

Phases

Eight phases, from scoping to attestation.

  1. Scoping and threat modelling

    Agree targets, roles, rules of engagement, and the threats that matter most to your business.

  2. Reconnaissance and mapping

    Map the attack surface: features, endpoints, hosts, identities and trust boundaries.

  3. Manual testing

    Work through each area by hand, guided by the relevant standard, with tools for coverage.

  4. Exploitation and validation

    Safely prove impact, chain issues where possible, and discard anything we can’t reproduce.

  5. Risk rating

    Score each finding with CVSS, then adjust the narrative for your real business impact.

  6. Reporting

    Write up findings with evidence, reproduction steps and clear remediation.

  7. Walkthrough

    Take your team through the results and answer questions on fixes.

  8. Retest and attestation

    Verify your fixes, update the report and issue an attestation letter.

Tools vs humans

Tools give us coverage. People find what matters.

Tools support coverage

Crawling, fuzzing and configuration checks help us cover a large surface quickly and consistently.

Humans find logic and chains

Authorization gaps, workflow abuse and chained attacks need someone who understands what the system is for.

Every finding verified

Nothing goes in the report until a tester has reproduced it by hand. No unverified scanner output.

Severity model

Ratings that reflect business impact.

We score every finding with CVSS v3.1 for consistency, then explain what it means for your business, so you can decide what to fix first.

  • Critical

    An attacker can cause serious harm now, such as taking over accounts at scale, reading other customers’ data or gaining control of systems. Fix immediately. We alert you during testing, not at the end.

  • High

    Significant harm is possible, but it needs some conditions, such as a valid account or user interaction. Fix as a priority, usually within days.

  • Medium

    Real weaknesses with limited direct impact, or issues that help an attacker go further. Plan a fix in your normal release cycle.

  • Low

    Minor issues that add little risk on their own but weaken your defences. Fix when convenient.

  • Info

    Observations and hardening advice that are not vulnerabilities in themselves.

Report structure

What the report contains.

  1. 01

    Executive summary

    Overall risk, key themes and priorities in plain English.

  2. 02

    Scope

    What was tested, when, from where, and what was excluded.

  3. 03

    Methodology

    Standards followed and the approach taken.

  4. 04

    Findings

    Description, impact, evidence, reproduction steps, remediation and references for each issue.

  5. 05

    Retest status

    Which findings are fixed, partly fixed or still open after retest.

  6. 06

    Appendix

    Supporting detail, such as tested endpoints, accounts used and tool output where useful.

See it in a sample report

Safety

Testing that never puts your business at risk.

  • Written authorisation first. No testing starts without signed authorisation and agreed rules of engagement.
  • No destructive testing without consent. Anything that could affect availability or data is agreed with you in advance.
  • Stop on request. You can pause or stop testing at any time, and we stop immediately.
  • Careful data handling. Encrypted storage, least-privilege access and deletion after an agreed period. See our Trust page.

See the methodology in action.

Request our redacted sample report to see how findings, evidence and retest status are presented.

Get a quote Request a sample report