Black box
External perspective
The tester starts without internal knowledge or credentials, closely reflecting the perspective of an external threat actor.
Methodology
Assessments supported by evidence, under controlled conditions.
Every penetration test and IT audit starts with defined objectives and written authorization. The method and assessment criteria are selected to match the environment and required assurance.
Gray box
Informed perspective
Limited access and context are provided to examine authenticated areas and test realistic privilege boundaries efficiently.
White box
Review with full context
Architecture, source code, and administrative context can be included for deep coverage and assurance during development.
Rules of engagement
Professional control at every stage.
Written scope and authorization
Confidentiality agreement signed before testing
Named escalation contacts
Agreed testing windows
Validated findings with evidence
Remediation guidance ranked by risk
From scope to confirmation.
01
Scope & authorization
Define objectives, approved systems, constraints, test windows, contacts, and rules of engagement.
02
Discovery
Establish the authorized attack surface, architecture, user roles, assets, and applicable assessment criteria.
03
Controlled testing
Assess the approved scope using manual and technical methods appropriate to the environment.
04
Validation
Confirm findings safely, remove false positives, and establish practical technical and business impact.
05
Reporting
Receive findings supported by evidence, risk ratings, an executive summary, and remediation priorities.
06
Remediation review
Review proposed corrective actions and clarify implementation priorities with the assessment team.
07
Retest
Verify agreed fixes and record whether each tested finding has been resolved, reduced, or remains open.