How we test: scope, authorization and rules of engagement
We only test systems you own or are authorized to test, with written permission. Here is exactly how an engagement is set up and kept safe.
- 01
Written authorization first
No testing starts until an authorized person at your business signs our engagement agreement and a written authorization naming the systems in scope. If a system is hosted by a third party (for example a cloud or website host), you confirm you have the right to authorize testing under that provider's rules.
- 02
Agreed scope
We list exactly what is in scope (domains, IP ranges, apps, user roles, AI features) and what is out of scope. Anything not listed is not touched.
- 03
Rules of engagement
We agree testing windows, named contacts on both sides, what techniques are allowed (for example whether phishing or phone pretexting is included), and how to pause testing at any time.
- 04
Safe testing
We avoid denial-of-service and destructive actions unless you ask for them in writing. We use test accounts where possible, and the plan names who to call if anything could affect your operations or customers.
- 05
Urgent findings
Critical issues, or signs of a past or active compromise, are raised with your contact as soon as practical instead of waiting for the report.
- 06
Human control of AI
AI models help us cover more ground. A person plans the test, reviews what the models propose before it touches your systems, and checks findings before they are reported.
Insurance and paperwork
- Insurance: [Professional liability (E&O) and cyber liability coverage details]
- Mutual NDA available before scoping.
- Engagement agreement, statement of work and authorization letter: [templates under lawyer review]
Tell us what you run. We'll tell you where we'd get in.
A free call, usually about 30 minutes, with one of the people who run the tests. We share the three things we would check first, whether you hire us or not.