01
Plan & authorize
Confirm objectives, target assets, exclusions, contacts, timing and rules of engagement.
02
Assess & validate
Perform agreed security testing with safety controls and communication checkpoints.
03
Report findings
Document evidence, impact, severity and reproducible context appropriate to the engagement.
04
Remediate & improve
Provide prioritized guidance and agree any retesting or follow-up validation.
Authorization comes first.
Testing is performed only on systems and assets explicitly authorized by the client, within the agreed scope and time window. Out-of-scope systems are not tested.