How we work
Organisation is key to success
That is why most of our projects follow a general baseline. It keeps the work predictable for you and honest for us.
Discovery phase
1. Kickoff meeting
A meeting, online or in person, to get the high-level requirements, constraints and expectations for your project. We tell you more about us, past projects and our first thoughts on this one.
Offer phase
2. Business proposal
A detailed offer tailored to your project, with time and cost estimates and any other artefacts it needs, such as action items or KPIs.
Commitment phase
3. Work effort
We do our thing: tests, audits or whatever the project requires, within the time frame agreed in the requirements.
Report and delivery phase
4. Results handover
We present the outcome: recommendations, a business report with a risk assessment, a technical report with proofs of concept, or whatever goals we agreed on. With a meeting, or without one if you prefer.
Feedback phase
5. Project closing
We ask how the project went for you and, if needed, go back and clear things up before closing it.
We can adapt to your requirements.
Testing methodologies
No prior knowledge
Black box
Performed without any prior knowledge of the target infrastructure or application. It simulates a real attacker who has to make their way from the outside in, through the publicly available endpoints of a network or system.
User-level knowledge
Grey box
Combines the other two: we start with the knowledge of a basic user, or of a user with elevated privileges. A more focused effort that finishes faster, with the possibility that some paths an outsider would find stay untested.
Full access
White box
Also known as clear box or logic-driven testing. The most time-consuming of the three, because there is a lot of information to process. With access to everything, including source code, it gives the most comprehensive assessment of internal and external vulnerabilities.
Terms that fit how you buy
Confidentiality first
We are strict on confidentiality and respect your company's image. We can sign an NDA even before the first meeting.
Contract types
Fixed price (FFP, FPIF, FP-EPA), cost reimbursable (CPFF, CPIF, CPAF, CPPC) or time and materials.
Frameworks
ISO, NIST, COBIT and PSR among others, with tests adapted to GDPR, HIPAA or HISO where needed.
Guidelines
OSSTMM, PTES, OWASP, ISSAF, PCI PTG, NIST SP 800-115, CICA ITAC, or a custom one if the project requires it.
Start with the kickoff
One meeting to understand your requirements, constraints and expectations.