Company / Our methodology
Evidence at every step.
An assessment should show how it reached its conclusions. Our approach follows the evidence from the public footprint to an agreed test and a practical recommendation, with the scope and uncertainty kept visible throughout.
Keep the reasoning visible
Define the boundary
Business concern, assets, and permissions
Build the outside view
Sources, context, and ownership questions
Validate what matters
Authorized checks with explicit limitations
Turn evidence to work
Priorities, owners, and verification choices
The assessment moves through a defined boundary, public research, validation, and action.
01 / A CLOSER LOOK
01 / Define the boundary.
Begin with the business concern. Agree which entities and assets belong in scope, which techniques are permitted, and which activities are excluded. Identify who can authorize the work and who should receive urgent findings. These decisions guide the investigation.
FOCUS POINTS
- Asset ownership and third-party permissions.
- Testing windows, exclusions, and stop conditions.
- Deliverables, communication, and evidence handling.
02 / A CLOSER LOOK
02 / Build the outside view.
Research public assets, available information, and relevant relationships within the agreed boundary. Record the source and context for an observation. Treat uncertain attribution as a question to resolve, rather than assuming every related domain or service belongs to the organization.
FOCUS POINTS
- Domains, internet-facing applications, and services.
- Public code, documents, and organizational information.
- Apparent dependencies and ownership gaps.
03 / A CLOSER LOOK
03 / Validate what matters.
Prioritize plausible paths that relate to the business question. Where authorized, test the necessary behavior and capture evidence sufficient to explain the result. Record what was confirmed, what remains an inference, and which conditions the assessment did not test.
FOCUS POINTS
- Agreed validation depth for each relevant path.
- Evidence tied to a specific asset and observation.
- Limits that prevent a conclusion from being overstated.
04 / A CLOSER LOOK
04 / Turn evidence into action.
Present findings with business context, recommended actions, and a proposed order of work. Review the results with your team and agree whether follow-up verification is needed. A retest revisits specified findings under a separately defined scope and timing.
FOCUS POINTS
- Risk reasoning that supports prioritization.
- Suggested responsible teams and verification criteria.
- A record of resolved, unresolved, and untested items.