A defined engagement, from first meeting to a report you can use.
Targets, authorization, schedule and fee are written down before anything runs. A named analyst is accountable for the findings.
The same four steps, wherever the client sits.
An introductory meeting comes first. We discuss the project and your concerns — what is in scope, what is not, and whether a written engagement is warranted. There is no fee for that conversation. No work begins afterward unless you approve the scope and fee.
The process does not change because the work is an audit, a test, a third-party review or an AI engagement. It does not change because the client is in Canada, elsewhere in the Americas, Ireland, Singapore or the Cayman Islands. Remote review is the default. On-site work is scoped when the property, the hosting or the evidence requires it.
If we are not the right firm, we say so in the first reply rather than stretching the brief.
01 · Scope
Write it down before access
We name the systems, applications, models, vendors or properties under review. We record who is authorized to grant access, what is out of bounds, the schedule and the fee.
Your NDA is executed on request before credentials are issued or testing begins. We only test what you own or are authorized to have tested.
02 · Assess
Analysis, then a named reader
Automated and AI-assisted analysis is used where it helps. Nothing is reported until a named analyst has read it. Unconfirmed items stay labelled as such.
High-impact or destructive tests are off by default. Production impact is agreed in advance. You have a named stop contact while work is running.
03 · Report
A record counsel can read
Findings are prioritized, with evidence. Method, coverage and limitations are stated in the same document. Technical and executive readers get the same facts.
The report is confidential to the named client. You may share it with counsel, insurers, auditors or a board. We do not publish client names or findings.
04 · Advise
Review, sequence, retest
We walk the report with your team, sequence remediation and answer questions on what was in and out of scope. Retesting is available on request.
There is no requirement to buy hosting, tools, cameras or a monthly retainer to receive the report. Affiliated companies, if any, are not a condition of the engagement.
Authorization first. Access second.
A useful first message names the target, the deadline and who has to read the report. A URL is enough to start a website discussion. For an application, a vendor or an AI deployment, say what it does and who it can act as.
International work is usually remote: access, logs and interviews by appointment. Travel is written into the scope before it is arranged. Typical assessments complete in one to four weeks, including the report. We reply to new inquiries during business hours, usually within one business day.
Written into every engagement
- Named targets and a named analyst
- Fixed fee before work begins
- Production impact agreed in advance
- Method, coverage and limits in the report
- Client material is never used to train or tune a model
Request a written proposal.
Describe the system, vendor or AI deployment under consideration. We respond with the proposed scope, timeline and fee.