Our approach
A structured process from scope to improvement
Four stages provide an overview of the engagement. Activities, safeguards and deliverables are agreed during scoping.
-
Scope
Agree objectives and boundaries.
-
Authorise
Confirm permission and rules.
-
Test
Conduct testing within agreed constraints.
-
Improve
Report findings and validate fixes where agreed.
Engagement elements
Eight key elements
These elements structure the discussion around a focused, controlled assessment and useful follow-up.
- 01
Define the objective
Agree the questions, systems and intended outcomes.
- 02
Written authorisation
Confirm permission, scope and testing windows.
- 03
Rules of engagement
Agree permitted activities, exclusions and contacts.
- 04
Operational constraints and stop conditions
Define operating limits and when testing must stop.
- 05
Communication and escalation
Establish contacts and urgent reporting arrangements.
- 06
Evidence handling
Agree collection, access, retention and disposal.
- 07
Reporting and improvement
Connect technical evidence with prioritised actions.
- 08
Retesting where agreed
Validate agreed fixes within the engagement scope.
Activities and deliverables are confirmed during scoping for each engagement.
More about the engagement arrangements
The steps below show how an engagement is typically run. Each step is agreed with you during scoping and can vary between engagements.
-
1. Define the objective
Agree the questions the assessment must answer, the systems and environments concerned, and what a useful outcome looks like for your organisation.
-
2. Written authorisation
Testing starts only after the organisation approves the scope, the systems and the testing window in writing. Unauthorised systems are excluded.
-
3. Rules of engagement
The rules set out permitted techniques, excluded systems, prohibited actions, accounts and data handling, and named contacts.
-
4. Operational constraints and stop conditions
Testing windows, rate limits and fragile systems are agreed in advance. Testing stops immediately if a stop condition is met, such as unexpected impact or a suspected real incident.
-
5. Communication and escalation
A named tester and a named client contact agree how and when to communicate, including urgent escalation for critical findings during testing.
-
6. Evidence handling
Evidence is collected only as far as needed to prove an issue. Sensitive data is minimised, access is restricted and evidence is retained and disposed of as agreed.
-
7. Reporting and improvement
Findings are reported with evidence, business impact and practical remediation advice, in a form suited to both technical teams and decision-makers.
-
8. Retesting where agreed
Where retesting is included, fixes are validated and the result is recorded. Retesting is not assumed unless the engagement says so.
These commitments describe the intended process. Each element is confirmed with the client for the specific engagement before work starts.