Our approach

How a security engagement works

Clear scope, safe testing, plain-English reporting, and support until the gaps are closed. No surprises, no shelfware.

Talk to a security expert Learn more
  1. 01

    Scoping & rules of engagement

    Days, not weeks

    We learn your business, environment, and concerns, then define exactly what’s in scope. For testing engagements, we agree in writing on targets, timing, contacts, and what’s off-limits before anything begins.

    • Defined scope & objectives
    • Written rules of engagement
    • Fixed quote & timeline
    • Mutual NDA
  2. 02

    Assessment & testing

    Typically 1–4 weeks

    Senior practitioners assess and test your environment using recognized methodologies. We communicate throughout, and critical findings are reported immediately — not held for the final report.

    • Manual testing & review
    • Framework-mapped analysis
    • Immediate critical alerts
    • Evidence collection
  3. 03

    Reporting & readout

    Within days of testing

    You receive an executive summary for leadership and detailed technical findings for your team, each with severity, evidence, and remediation steps. Then we walk you through it live.

    • Executive summary
    • Risk-ranked findings
    • Remediation guidance
    • Live readout session
  4. 04

    Remediation support

    Your pace

    Fix issues with your IT team, your MSP, or ours. We answer questions, review fixes, and help prioritize so the highest-risk gaps close first.

    • Prioritized roadmap
    • Hands-on help if needed
    • Developer & IT guidance
    • Progress check-ins
  5. 05

    Retest & continuous improvement

    Ongoing — your choice

    We verify that fixes worked and document the improvement. Many clients continue with vulnerability management, a vCISO engagement, or an incident response retainer.

    • Retest & updated report
    • Attestation letter
    • Ongoing monitoring (optional)
    • Annual reassessment
FAQ

Working together

Don’t see your question? Ask our security team directly.

How do you protect our data during an engagement?

We work under NDA, limit access to the practitioners on your engagement, store evidence encrypted, and securely destroy test data after the engagement unless you ask us to retain it.

Do we need to tell our IT provider or hosting company?

Usually, yes. Some cloud and hosting providers have testing policies, and notifying your IT team prevents a test from being mistaken for a real attack — unless you intentionally want to test detection, which we plan carefully with a trusted contact.

How do you price engagements?

Most assessments and tests are fixed-price based on scope. Ongoing services like vCISO, vulnerability management, and incident response retainers are monthly or annual agreements.

Ready to see where you stand?

Talk directly with a senior security practitioner about where you’re exposed and what to fix first — no sales script, no obligation.

Book a security consultation Active incident? Get help now