Pre-release security review
Focused assessment of a new application, feature, API, or architecture change before production exposure.
1-3 weeksApp + API
Engagements
Security work with clear boundaries and useful outcomes.
From a release-focused application test to a broader attack-path assessment, the engagement starts with the decision you need to make.
Representative tracks
Choose the risk question - not a testing commodity.
These are common ways to shape an engagement. They are service models, not claims about named customers or confidential work.
External attack-surface assessment
Discover and validate exposed systems, services, identity entry points, and practical routes toward critical assets.
ExposureInfrastructure
Cloud privilege-path review
Examine identity, workload, network, secret, and storage controls for escalation and lateral-movement opportunities.
CloudIAM
Exploitability deep dive
Resolve uncertainty around a high-impact finding, component, CVE, or vendor claim with evidence and safe validation.
ResearchPoC
Attack-path assessment
Test whether separate weaknesses can be chained across application, identity, and infrastructure boundaries.
ChainingImpact
Remediation verification
Retest fixes, inspect likely bypasses, and give stakeholders confidence that the original risk is actually closed.
RetestAssurance
Delivery flow
Predictable process. Adaptive testing.
The administrative parts stay clear so technical time can go toward finding and validating the risk.
Discovery & scoping
Confirm business context, assets, exclusions, accounts, environments, data-handling expectations, and success criteria.
Rules of engagement
Agree testing windows, escalation contacts, prohibited actions, evidence handling, and stop conditions before activity begins.
Assessment
Run manual and tool-assisted testing, communicate critical discoveries early, and adapt effort as attack paths emerge.
Report & readout
Deliver prioritized findings and attack-path context, then work through the results with technical and business owners.
Remediation & retest
Answer fix questions, evaluate compensating controls, and verify remediation when included in the engagement.
Deliverables
One result, multiple audiences.
Artifacts are structured so leaders can prioritize and engineers can reproduce, understand, and fix.
| Artifact | Primary audience | Purpose |
|---|---|---|
| Executive summary | Leadership, risk owners | Exposure, likely impact, systemic themes, and priority decisions. |
| Technical report | Security, engineering | Evidence, reproduction, root cause, severity rationale, and remediation direction. |
| Attack-path narrative | Security architecture | Shows how multiple weaknesses or trust boundaries combine into material impact. |
| Readout workshop | Cross-functional owners | Challenge assumptions, transfer context, and align on the remediation plan. |
| Retest note | Assurance, engineering | Records what was verified, what remains, and any nearby bypass conditions. |
Operating principles
Safe testing is part of good testing.
The exact controls are agreed per engagement, but authorization and operational safety are never implied.
Written authorization
Assets, environments, testing methods, and accountable contacts are confirmed before work begins.
Minimum necessary impact
Findings are proven with the least disruptive method that establishes the risk within scope.
Critical escalation
Severe or actively dangerous conditions are communicated through the agreed channel without waiting for the final report.
Controlled evidence
Sensitive evidence is minimized, handled according to the agreed engagement terms, and never published as portfolio material.
Plan an engagement
Start with the risk you need answered.
Send a short description of the system, timing, and objective. We’ll help shape the scope.