Methodology.
Whether passive intelligence or an authorized test: every assessment follows the same four principles. No tool decides on its own what counts as a finding.
01
Automation for coverage
Modern tooling and AI-assisted analysis make sure nothing relevant gets missed. They produce candidates, not verdicts.
02
Manual verification
No finding reaches the report unreviewed. Every relevant hit is validated by hand and backed with evidence.
03
Contextual risk analysis
The same technical finding can be harmless or critical. We rate it in the context of your business, not by tool score.
04
Clear remediation
Every finding ends in a concrete, actionable recommendation with priority, understandable for leadership and IT.
Passive and active, clearly separated.
Our intelligence assessments (External Exposure Intelligence, Brand Protection, Digital Footprint & Breach Exposure) work with lawfully accessible public sources and authorized intelligence databases: DNS and registration data, public registers and documents, search engines, and known breach indices. We never access third-party systems, never bypass access controls, and never obtain data from illegal sources.
Active security testing (web application and API penetration tests, smart contract reviews) happens only after explicit written authorization and within a clearly defined scope, with agreed targets and an agreed timeframe.
The severity model.
Every finding communicates evidence, severity, risk, potential impact, and a recommendation. Ratings follow a defensible model, not an arbitrary score:
- Critical
Immediately exploitable with severe impact; act right away.
- High
Realistically exploitable or with substantial impact; fix promptly.
- Medium
A relevant risk under certain conditions; fix as planned work.
- Low
Limited risk or hard to exploit; fix opportunistically.
- Informational
No immediate risk, but useful context or a hardening recommendation.
How an engagement runs.
- 01
Intro call
Together we define the relevant domains, brands, applications, and goals of the assessment.
- 02
Analysis
We analyze publicly visible information, domains, identities, and brand risks. Active testing happens only within an authorized scope.
- 03
Manual verification
We validate, contextualize, and prioritize every relevant finding.
- 04
Report & debrief
You receive the report, a prioritized action plan, and a clear walkthrough of the results.
What we deliberately don't do.
- No active testing without explicit written authorization, a defined scope, and an agreed timeframe.
- No 24/7 security operations center, no managed security services, and no incident response operations.
- No security promises like “unhackable” or “100% secure”: we communicate findings and residual risk honestly.
- No invented metrics, reference customers, or certifications.
This focus is intentional: it keeps assessments risk-free for your operations and the results dependable.
Questions about the methodology?
In the intro call we explain approach, sources, and the limits of each assessment, openly and without sales pressure.