Discover
Understand the business trigger, critical operations, people involved, and the decision the engagement needs to support. Identify relevant past work and constraints without asking for sensitive evidence in a public form.
Our approach
Clarity in the scope.
Purpose in the work.
A security engagement should be understandable before it starts and useful after the final meeting.
The delivery framework
From the first question
to the next decision.
The exact activity depends on the engagement. These stages establish a shared understanding of the work.
Scope & authorize
Record systems, environments, exclusions, objectives, deliverables, schedule, and responsibilities. For active testing, agree written permission, allowed techniques, testing windows, escalation contacts, and stop conditions.
Prepare
Arrange the necessary evidence, accounts, documentation, and access through a process agreed with the client. Confirm prerequisites and clarify what happens if an environment or dependency is not ready.
Examine & communicate
Carry out the authorized activity. Separate observations from validated findings and assumptions. Discuss significant issues through the agreed contact route, with attention to business context and operational constraints.
Report & prioritize
Present the scope, evidence, limitations, and recommendations in a form useful to technical owners and leadership. Identify priorities and dependencies rather than presenting every issue as equally urgent.
Review & follow through
Walk through the findings and answer questions. Agree whether implementation, further assessment, or retesting belongs in a subsequent scope. Close out access and evidence arrangements according to the engagement.
Public reference points
A framework informs.
The scope defines.
Frameworks can provide shared terminology and structure. The engagement identifies which references and versions are relevant.
Before we begin
Good questions.
Clear expectations.
The details that make a better engagement.
How long will the engagement take?
The delivery schedule depends on scope, complexity, access, and client availability. A consultation is the starting conversation; the proposal establishes the wider delivery schedule.
Are fixes included?
The proposal identifies whether remediation, implementation support, validation, or retesting is included. Recommendations alone do not imply that every change will be implemented.
What happens to sensitive materials?
Agree the evidence, transfer method, access, retention, and closeout requirements with the team before sharing materials. The public website is not an incident evidence upload service.