How an engagement works
Four steps, the same for every service. You always know what is in scope, who is authorized, what we found and what changed.
Scope and authorization
A short call to agree what is in scope, what is out, and when. You confirm in writing that you own or are authorized to test it.
We test
AI-assisted discovery across the build you ship, then manual verification of every finding. No false positives reach you.
Evidence-backed report
Each finding with severity, exact location, proof and a fix. Plus a plain-language summary for the people who sign things.
Fix and re-test
Your team fixes, or ours does. Then we re-run the same tooling and show what has changed.
Scope and authorization
We start with a 30-minute call: what the application does, which platforms ship, what you are worried about, and what must not be touched. From that we write a one-page scope: the hosts, builds, accounts and time window in scope, the deliverables and a fixed price. Testing does not begin until someone entitled to approve it has signed, and we have an emergency contact on your side.
We test
We work from the artefact your users get, the way an outsider would: the production bundle, the APK or IPA, the installer, the deployed contract. AI-assisted reverse engineering and scanning cover ground fast; a person reproduces every candidate finding, measures its real impact and records the evidence. Anything critical and live is reported to your emergency contact the day we confirm it.
Evidence-backed report
You get two documents. The technical report lists each finding with severity, where it lives, the decompiled excerpt or captured request that proves it, what it lets an attacker do and how to fix it, in priority order. The executive summary says in a page what is exposed, what is fine and what to do first. We walk your team through both on a read-out call.
Fix and re-test
Fixes are yours to make, or you can have us implement the hardening in your codebase and build pipeline. Either way we re-test every finding within the engagement window and issue an updated report marking each one closed, mitigated or open, with the before-and-after evidence. For penetration tests that includes a letter of attestation you can share with customers.
What we need from you
- Someone entitled to authorize testing of the application.
- The build or URL in scope, and test accounts where relevant.
- A contact we can reach during the testing window.
- An hour of your team's time for the scoping call and the read-out.
We only test applications you own or are explicitly authorized to test.
What you get
01Technical report
Every finding with severity, location, evidence and fix, in priority order.
02Executive summary
One page on what is exposed, what is fine and what to do first.
03Read-out call
We walk your team through the findings and answer questions.
04Re-test and attestation
Fixed findings verified, an updated report, and a letter you can share.
Next step
Find out what your app gives away. Book a free exposure call.
Thirty minutes with an engineer, not a sales deck. Tell us what you ship; we tell you what we'd look at first and what an audit would involve.
We only test applications you own or are explicitly authorized to test.