How an assessment runs
Every engagement follows the same five steps, so you always know what is happening and what you will get at the end. This is a draft for founder review.
1. Scope
We agree what is in and out of scope, the dates, and who to call if something goes wrong. We sign a mutual NDA before any technical discussion.
2. Plan
We choose the tests that fit your systems and your risks. You approve the plan before we start.
3. Test
We test only what is in scope and only in the agreed window. We tell you straight away if we find something serious.
4. Report
You receive a written report in plain English. Each finding says what we found, why it matters, how to fix it and how urgent it is.
- A summary a manager can read in five minutes
- Technical detail your team can act on
- Evidence so you can check each finding
5. Retest
After you fix the issues, we check the fixes. FOUNDER_TO_SUPPLY: what retesting is included in each package.
Standards we refer to
Where it helps, we map findings to well-known public references such as the OWASP Top 10, CIS Benchmarks and NIST guidance. FOUNDER_TO_SUPPLY: confirm the exact list.