Open Source Security Testing Methodology Manual (OSSTMM) (PDF)
A scientific, metrics-driven approach to security testing.
How we work
The job isn’t done until the findings are fixed
A clear, predictable process from the first call to the retest, with no surprises for your team.
Process
What to expect
Scoping call
We learn your environment, goals, deadlines and compliance needs.
Proposal
A statement of work with scope, schedule, rules of engagement and pricing.
Testing
Hands-on testing within agreed windows. Critical issues are reported to you immediately.
Validation
Every finding is exploited by hand, safely, to prove real impact and remove false positives.
Report & readout
An audit-ready report and a walkthrough with your team.
Retest
We retest remediated findings within 45 days and confirm they are closed.
Standards
Grounded in recognized testing standards
Our methodology draws on established frameworks and the compliance standards our clients answer to, combined with hands-on experience from more than two decades of testing.
OWASP Web Security Testing Guide (WSTG)
The go-to framework for web application assessments.
NIST Special Publication 800-115 (PDF)
The U.S. government’s technical guide to security testing and assessment.
Penetration Testing Execution Standard (PTES)
A practical, phase-driven standard that mirrors how real engagements are conducted.
Payment Card Industry Data Security Standard (PCI DSS)
The payment card industry’s security standard, including requirement 11.4 for regular penetration testing and segmentation testing.
Your report
What’s in every report
- Executive summary for leadership and auditors
- Scope, methodology and testing timeline
- Findings ranked by severity with business impact
- Evidence and step-by-step reproduction
- Remediation guidance specific to your environment
- Retest results confirming what has been fixed
Our commitments
How we protect you during testing
Safe testing
We avoid exploits that could destroy data or take systems offline, and we follow the rules of engagement we agree on.
Confidentiality
We can sign a confidentiality agreement before scoping, and your findings are shared only with the people you designate.
Clear communication
A single point of contact, regular updates and immediate notice of anything critical.
Ready to get started?
The first step is a short scoping call.