How the testing actually works.

Engagement phases

1. 01

   Scoping and authorisation

   The boundary is agreed in writing before anything is touched: systems in scope, systems explicitly out, permitted techniques, testing window with timezone, escalation contacts and stop conditions. NDA and a signed authorisation letter are in place first.

   You receive: Signed scope, rules of engagement and authorisation letter

2. 02

   Reconnaissance and mapping

   The attack surface is enumerated and mapped in full before any testing begins. Assets nobody remembered deploying are a recurring finding in their own right.

   You receive: Asset inventory and tested-surface map

3. 03

   Manual testing

   The bulk of the engagement. Automated tooling is used to cover breadth, but every finding is manually verified and every access-control and business-logic path is tested by hand. Tools do not find logic flaws.

   You receive: Verified findings with evidence

4. 04

   Exploitation and impact

   Findings are taken far enough to demonstrate real business impact, and no further. Nothing destructive, nothing that risks availability, and critical findings are escalated to you immediately rather than held for the report.

   You receive: Proof of impact, and same-day escalation for anything critical

5. 05

   Reporting

   An executive summary written for a board reader, and a technical body written for the engineer who has to fix it. Findings are CVSS-scored with reproduction steps, and the annexure records what was tested and came back clean.

   You receive: Full report, delivered directly to you

6. 06

   Retest and closure

   Once the fixes are in, high and critical findings are retested and a signed closure letter confirms what is actually closed. An auditor asking for evidence of remediation needs this, not an email.

   You receive: Signed retest letter on letterhead

Standards applied

No single framework covers an engagement on its own. Each is used for the part it is actually good at.

PTES

Overall engagement structure, from scoping through reporting

OWASP ASVS 4.0

Web application coverage and verification depth

OWASP API Security Top 10

API-specific flaw classes, particularly authorisation

OWASP MASVS

Mobile application coverage across both platforms

MITRE ATT&CK

Realistic attack path modelling on internal engagements

NIST SP 800-115

Technical assessment process and evidence handling

CIS Benchmarks

Cloud and host configuration comparison

OWASP Top 10 for LLM Applications (2025)

Coverage and finding taxonomy for AI and LLM engagements

MITRE ATLAS

Adversarial technique modelling against machine learning systems

NIST AI Risk Management Framework

Risk framing for AI findings, in language a governance team recognises

What the report contains

• Executive summary

  Business impact in plain language, written to be read by someone who is not an engineer.

• CVSS-scored findings

  Every finding with a vector, reproduction steps and captured evidence — not a scanner ID and a severity label.

• Prioritised remediation roadmap

  Ordered by real risk and by effort to fix, so the first week of work is the right week of work.

• Technical annexure

  Everything tested, including what came back clean. Coverage you can show an auditor.

• Retest and closure letter

  Signed confirmation of what was fixed and verified, on letterhead.

Retesting and closure