Skip to content
v1olet

Scope. Test. Report. Retest.

The same four stages on every engagement, with the same commitments attached to each. No stage exists to fill a slide — each one produces something you can hold.

Stages
4
Retest
Included in price
Critical findings
Escalated same hour

  1. Scope

    Typically one scoping call plus written confirmation

    Fixed price and a named lead before anything starts.

    We agree the targets, the rules of engagement, the testing window, and the escalation path. You receive a fixed price and the name of the operator who will lead the work before a single request is sent. Scope creep is handled as a written change, not as a surprise on the invoice.

    Exists at the end of this stage

    • Signed scope and rules of engagement
    • Fixed price and testing window
    • Named engagement lead
    • Escalation contacts on both sides

  2. Test

    Agreed window, typically 5–15 working days

    Findings reach you the hour they are confirmed.

    Testing runs against a shared channel with your team. Anything critical is escalated immediately — the hour we confirm it, not in a report six weeks later. You can watch the engagement progress rather than waiting for a document, and your engineers can start on a fix while the operator is still in the environment to verify it.

    Exists at the end of this stage

    • Shared channel with the operators
    • Immediate escalation of critical findings
    • Running list of confirmed issues
    • Daily progress notes on longer engagements

  3. Report

    Delivered within five working days of test completion

    Every finding reproducible, with a proof of concept.

    Each finding lands with reproduction steps, a working proof of concept, an assessment of business impact, and remediation your engineers can act on. Severity is argued from impact in your environment, not copied from a scanner. The report carries both an executive summary you can hand to a customer or auditor and the technical detail your developers need.

    Exists at the end of this stage

    • Technical report with reproduction and PoC per finding
    • CVSS v4.0 vector and business-impact rationale
    • Executive summary for non-technical distribution
    • Remediation guidance mapped to your stack

  4. Retest

    Scheduled once fixes ship, within the engagement price

    Included in the original price.

    Once you have shipped the fixes we verify each one and reissue the report with the resolved findings marked and dated. The reissued report is the artefact you can show a customer, an auditor, or a procurement team. This is included — it is not a second engagement.

    Exists at the end of this stage

    • Verification of each remediated finding
    • Reissued report with resolution status and dates
    • Attestation letter on request
    • Notes on any fix that did not fully close the issue

What we commit to

These are contractual, not aspirational. If any of them is not in your engagement document, it is missing and we will put it there.

  • No subcontracting

    The operators named in your scope document are the ones who do the work. The team page is the whole bench.

  • Retest included

    Verification of your fixes and a reissued report are part of the original price, not a follow-on quote.

  • Findings as you go

    Critical issues are escalated the hour they are confirmed. You do not learn about them at the readout.

  • Fixed price

    Agreed before the engagement starts. Scope changes are handled in writing, with a price attached, before they happen.

  • Reproducible or it is not a finding

    Every issue ships with the steps and the proof of concept needed to see it yourself.

  • A public record

    Our competition results are published by the organisers and linked from this site. The evidence is independently verifiable.

Executed against named standards

Methodology is not improvised per engagement. Each stage maps onto published standards, which is what makes coverage arguable rather than asserted.

Ready to scope something?

One call is usually enough to establish the targets, the window and the price.

Request an engagement