Cyber
Security

At minimum, annually — but the right cadence depends on how fast you ship code and how sensitive your data is. High-change SaaS products benefit from quarterly testing of new releases. Regulated industries (fintech, healthtech) often need to meet specific minimum frequencies defined by their compliance frameworks. We'll advise based on your risk profile.

A written findings report covering every identified vulnerability with a CVSS severity score, description of how it could be exploited, business impact, and specific remediation steps. Plus an executive summary suitable for board or investor reporting. We also conduct a debrief call with your technical team to walk through findings and answer questions.

We agree rules of engagement before any testing begins — including whether to test production or a staging environment. Most external web application tests can be performed safely against production with agreed safeguards. For internal network or infrastructure tests, we typically operate during low-traffic windows to minimise any risk of service disruption.

Yes. We start with a gap assessment against the target standard, produce a prioritised remediation plan, help you implement the required controls and documentation, prepare you for the external audit, and provide support during the auditor's assessment. Many clients come to us after failing a first attempt — we know exactly what auditors look for.