Methodology

A transparent, repeatable way to break things

Industry-standard methodology, sharpened by real-world attack experience. You always know what we're testing, how, and why.

The engagement, step by step

  1. Scope & rules of engagement

    A short call to understand your architecture, risks and goals. You receive a fixed-price proposal and written rules of engagement.

    • Mutual NDA signed before any technical details are shared
    • Scope, environments, test accounts and off-limits actions agreed in writing
    • Testing windows and emergency contacts on both sides

  2. Reconnaissance & threat modeling

    We map your attack surface — endpoints, roles, integrations and trust boundaries — and decide where an attacker would strike first.

    • Asset and endpoint discovery, technology fingerprinting
    • Role and permission matrix for every user type
    • Threat model of the flows that move money or data

  3. Manual exploitation

    Hands-on testing beyond checklists: chaining weaknesses, abusing business logic and proving real impact — safely.

    • Critical issues are reported immediately — not at the end
    • No destructive or denial-of-service testing without explicit approval
    • Automated tooling supports the work; it never replaces it

  4. Report & debrief

    A prioritized report with executive summary, technical findings, proof of concept and remediation guidance — walked through with your team.

    • Executive summary for leadership and the board
    • Each finding rated with CVSS 4.0 and business context
    • Live debrief call with engineering

  5. Retest & attestation

    After you fix, we verify every remediation and issue an updated report and a letter of attestation for customers and auditors.

    • Fix verification for every reported finding
    • Updated report reflecting the current risk
    • Attestation letter you can share with customers

Choose your level of access

Black box

No prior knowledge or credentials — the view of an outside attacker discovering you for the first time.

Recommended

Grey box

Test accounts for each role plus documentation. The most efficient way to reach deep authorization and logic flaws.

White box

Source code and architecture access, combined with code review for maximum coverage per testing day.

How we rate severity

Findings are scored with CVSS 4.0, then adjusted for your business context — a medium-scored bug in your payment flow may be your top priority.

Severity CVSS 4.0 score What it means
Critical 9.0–10.0 Trivially exploitable with severe impact — fix immediately.
High 7.0–8.9 Significant risk to data or systems — prioritize in the current sprint.
Medium 4.0–6.9 Exploitable under specific conditions — plan the fix.
Low 0.1–3.9 Limited impact, often defense-in-depth — fix when convenient.
Informational — No direct risk; hardening recommendations and best practice.

Deliverables

What every report contains

  • Executive summary & risk overview
  • Technical findings with proof of concept
  • CVSS 4.0 severity & business-impact rating
  • Step-by-step reproduction & remediation
  • Retest report & attestation letter

Sample finding format (illustrative)

TRS-07 High · 8.6

Cross-tenant invoice access via predictable object IDs

CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected
GET | PUT /api/v2/invoices/{invoice_id}

Impact

Any authenticated user can read and modify invoices that belong to other organizations by changing the numeric invoice_id — exposing customer names, addresses and payment details across tenants.

Proof of concept

GET /api/v2/invoices/48213 HTTP/2
Host: app.example.com
Authorization: Bearer <tenant-A token>

HTTP/2 200 OK
{"id": 48213, "org": "tenant-B", "total": 12400, ...}

Remediation

Enforce object-level authorization on every request: resolve the invoice through the caller's organization and return 404 for anything outside it. Add per-role regression tests.

CWE-639OWASP API1:2023

Rules of engagement & data handling

  • Written authorization signed by you before any testing begins
  • Testing only within the agreed scope, windows and request rates
  • Fixed, disclosed source IP addresses on request, so your team can tell us apart from real attacks
  • No denial-of-service, destructive or social-engineering techniques without explicit approval
  • Findings shared only over encrypted channels and stored encrypted at rest
  • Test artifacts and any data encountered deleted at the end of the agreed retention period

Standards we build on

OWASP WSTG
Web Security Testing Guide — the backbone of web testing
OWASP ASVS
Application Security Verification Standard — coverage requirements
OWASP MASVS / MASTG
Mobile security verification standard and testing guide
PTES
Penetration Testing Execution Standard — engagement phases
NIST SP 800-115
Technical guide to information security testing
MITRE ATT&CK
Adversary tactics and techniques for infrastructure testing
CVSS 4.0
Common Vulnerability Scoring System — severity rating

Ready to see your attack surface through an attacker's eyes?

Tell us what you're building. We'll come back with a clear scope, a timeline and a fixed price.

Request a pentest [email protected]