Four stages, with one thread running through them, from the first call to the retest.
You describe your environment, who uses it and what would hurt most if it failed. We come back with a scope, a timeline and a price. If a smaller test would answer your question, we say so.
Manual work inside agreed windows, with a named contact on your side and an agreed way to pause the test at any moment. A critical finding is reported as soon as it is confirmed, with a workaround if there is one, rather than held for the report.
One document, two readers. The first page is for the people who decide: what was found, what it means, what to do first. The rest is for the people who fix: the path in, the proof, the remediation. We present it to both.
Once the fixes are in, we go back over every finding and update the report with what held and what did not. The retest is part of the engagement.
The ground moves fast. AI has pushed up both the number of vulnerabilities being found and the speed at which they are exploited, and testing has to keep the same pace. These are the numbers from the industry’s own reports that we plan engagements around.
Average time in 2025 for an intruder to move from the first compromised machine to the next. The fastest observed: 27 seconds.
What it changes in a test Detection is tested as a timed exercise, not a checklist. That is what a purple team is for.
CrowdStrike Global Threat Report 2026Share of intrusions detected in 2025 that used no malware at all: valid accounts, built-in tools, stolen sessions.
What it changes in a test Identity, sessions and permissions get the same depth of testing as code.
CrowdStrike Global Threat Report 2026Share of breaches that began with an exploited vulnerability, up from 14.9% the year before.
What it changes in a test Internet-facing systems and devices are tested first, not last.
Verizon Data Breach Investigations Report 2025Share of a state-backed intrusion campaign carried out by an AI agent, with people stepping in at a handful of decision points.
What it changes in a test AI is on both sides now. We test the systems you build on language models, and we use AI in our own tooling where it makes us faster.
Anthropic, November 2025Year-on-year rise in zero-day vulnerabilities exploited before they were publicly disclosed, in 2025.
What it changes in a test Internet-facing systems are tested as if the next flaw is already known to someone. Patching is not a plan on its own.
CrowdStrike Global Threat Report 2026Share of breaches involving a third party, double the previous year.
What it changes in a test APIs, integrations and third parties come up at scoping, not after the fact.
Verizon Data Breach Investigations Report 2025We keep up with the attackers so that your test reflects the attackers of today, not of five years ago.
Attackers do not follow a checklist, but the people who fix things need one. Findings map to the references your engineers and auditors already know. The set below is the usual starting point; the engagement decides which apply.
Answered here so the call can go further.