Authorized attack simulation against only the systems you name.
A scheduled window, written rules of engagement, and a confidential report. Destructive production tests are off by default.
A test you authorized — not an unannounced attack.
Testing is an authorized attempt to demonstrate how an attacker could abuse a named system. It is scheduled, scoped and bounded by written rules of engagement. You have a named stop contact while work is running.
We recommend a test when a client, insurer or internal policy asks for one, or when an audit has already shown that a deeper, human-led attempt is warranted. If an audit or a public scan will answer the question, we say so instead of selling a larger test.
The same authorization rules apply for clients internationally. Adjacent networks, third-party clouds and customer devices are out of scope unless named.
Web, server and application
Authenticated and unauthenticated testing of the applications, hosts and services you list, within the accounts and roles you provide.
AI systems and agents
Prompt injection, agent misuse and data leakage against only the models and tools you authorize. See AI assurance for the broader review.
Retesting
After you apply fixes, we retest the agreed items and update the record. Retesting is scoped; it is not assumed in the first fee unless written in.
Production stays protected.
- Written authorization from someone who can approve testing of the named assets.
- Named targets only. Hostnames, applications, models and accounts listed in the statement of work.
- No destructive production tests by default. Denial-of-service and data destruction need a separate written approval.
- A stop contact. A name to halt testing if something unexpected happens.
What you receive
- Confirmed findings with evidence
- Reproduction notes sufficient for your team
- A debrief call
- Optional retest of agreed items
Penetration testing in more detail →
Request a written proposal.
Describe the system, vendor or AI deployment under consideration. We respond with the proposed scope, timeline and fee.