1

Scoping

Every engagement starts by defining assets, systems, and boundaries in scope alongside the client team.

2

Collection & analysis

Structured technical review, informed by threat models and, where relevant, live intelligence collection.

3

Severity classification

Every finding is classified against a consistent, comparable severity framework — not ad hoc judgment calls.

4

Reporting

Findings are delivered with clear severity, proof-of-concept detail, and prioritized remediation guidance.

5

Responsible disclosure

Where applicable, findings are coordinated with affected parties before any public disclosure.