Controlled. Non-destructive. Risk-based.
Our methodology draws on NIST SP 800-115 and the OWASP Web Security Testing Guide, with care for personal information under POPIA.
How it works
Four stages, no surprises.
Agree the scope
Confirm asset ownership, target lists, test windows, exclusions, contacts, and written authorisation.
Test with care
Map the approved attack surface and validate selected risks with controlled, non-destructive checks.
Prioritise what matters
Explain likely business impact alongside technical severity, evidence, and remediation guidance.
Verify improvement
Walk through the results and, where agreed, retest the original confirmed findings.
Rules of engagement
- Written authorisation before any testing begins
- Only explicitly approved assets, IPs, domains and URLs are tested
- Testing stops if instability or business impact is detected
- No denial-of-service, ransomware, destructive malware or persistence
- Credentials and evidence encrypted in transit and at rest
- Personal information limited to the minimum evidence needed
- Evidence securely destroyed after the agreed retention period
Clear reporting your board and engineers can both use.
Executive summary, technical findings with severity ratings, remediation guidance, a closeout walkthrough and, where agreed, a retest report.