01 / Scope
Agree targets and a safe approach
Targets, identities, time windows and prohibited actions are agreed before authorised testing starts.
Authorised penetration testing
Evidence within agreed boundaries
Testing has clear boundaries and evidence for each finding. Retesting can follow remediation when included in the proposal.
02 / Evidence
Document verifiable results
Each finding connects prerequisites, steps and minimal evidence with impact. Testing is a bounded engagement.
03 / Retest
Retesting can follow remediation
Where included, retesting verifies original conditions and identifies residual risk or new limitations.
Where risk is real, not merely theoretical
A Blackhat test combines an attacker's perspective with an understanding of defence. The aim is to find weaknesses that could genuinely harm your organisation, rather than produce the longest possible list of issues.
We propose a scope based on your environment and objectives. We clarify in advance what we will verify technically, which organisational questions we will assess and what the test will not cover.
- Mapping exposed services and typical attack paths.
- Verifying selected weaknesses within the agreed scope.
- Assessing related processes and defensive measures.
- Recommendations prioritised by impact and remediation effort.
Blackhat test, penetration test or scan?
Blackhat test
A broader assessment of the organisation's main risks. Suitable as a first step and a basis for further decisions.
Penetration test
Verifies in depth what can be exploited in a specific application, API or infrastructure. The scope is precisely defined.
Automated scan
Quickly identifies potential known vulnerabilities. It does not replace manual verification, contextual assessment or business logic testing.
Safe delivery and clear results
Before testing, we confirm objectives, authorised systems, testing windows, prohibited techniques and escalation contacts. Where agreed, a critical finding is reported promptly rather than waiting for the final report.
The report has two levels: a management summary and technical details for administrators. Each finding includes evidence, impact, recommended remediation and the limitations of the verification performed.
