Engagement Process
Structured, transparent, and no surprises. Every phase is documented and communicated clearly from initial scoping to final remediation retest.
Five Phases.
Zero Ambiguity.
Every engagement follows a consistent, documented methodology built on real-world offensive tradecraft, not a generic checklist approach.
Principal-Led.
Operator-Run.
Every engagement is scoped, executed, and reported by the same practitioner. There is no junior staff running automated tooling, no offshore delegation, and no account-management layer between the customer and the consultant. The person who scopes the engagement is the person handling the keyboard during testing, writing the findings, and answering questions during remediation. Customers work with a senior consultant directly, from first email to final report and any agreed re-test.
This model trades scale for depth. Cyber Security Pentesting runs fewer engagements per quarter than a large consulting firm. The engagements that do run get the full attention of someone whose technical background is verifiable through certifications, public CVEs, and published research, rather than a CV summary.
NDA
Before Anything Else.
No environment information, account inventory, or scoping detail is requested or discussed before an NDA is in place, where one is required. The initial conversation can happen without one (general approach, capability fit, timeline questions), but the moment a real environment is being described, the NDA, where required, goes first.
Credentials are exchanged through an agreed secure channel in accordance with the engagement's approved handling requirements. Final reports go to named recipients through a secure delivery method agreed during pre-engagement.
Rules of Engagement.
Signed Before Testing Begins.
Every engagement begins with a written rules-of-engagement document signed by both an authorised sponsor on the customer side and the consultant. The document covers:
- In-scope and out-of-scope assets, with named hosts, IP ranges, applications, identities, and accounts.
- Permitted and prohibited techniques, including denial of service, social engineering against unconsented individuals, and any operations against shared third-party infrastructure.
- Testing windows, with the customer's preferred working hours and any blackouts (releases, audits, financial close).
- Emergency contact, named and reachable during testing windows.
- Escalation triggers, defining which findings must be escalated through the out-of-band channel rather than held for the daily status note.
- Scope boundaries during the engagement. Testing is limited to the targets approved in the signed Rules of Engagement and written authorisation.
The signed ROE is the working document throughout the engagement. Any ambiguity is resolved by referring back to it rather than improvising.
Daily Status.
Immediate Escalation on Critical Findings.
During active testing, the customer receives a daily status note covering: what was tested today, what is planned for tomorrow, any blockers, and any findings worth raising. Critical findings are not held for the end-of-week summary. They are escalated promptly after validation, through the out-of-band channel agreed in the rules of engagement, with timing defined in the engagement proposal and enough information for the customer's team to begin containment if needed.
Coordination calls are scheduled as agreed, starting with a kickoff meeting. Ad-hoc calls happen when the engagement uncovers something that needs immediate two-way conversation. Communication channels are agreed in the ROE and used consistently throughout.
Every Finding
Manually Validated.
Every finding in a Cyber Security Pentesting report is manually validated. Scanner output is a starting point for enumeration; it is never the deliverable. Each issue is reproduced with documented steps, exploited where authorised to confirm impact, and contextualised against the customer's environment.
Reports include CVSS scoring alongside a contextual risk rating that reflects what the finding actually means in the customer's business. A CVSS 9.8 in a non-routable segment with no sensitive data has a different business risk than the same CVSS 9.8 on an internet-facing identity provider. The report makes that distinction explicitly so engineering and leadership can prioritise correctly.
Audit-Ready
Where It Matters.
Reports map to the compliance frameworks the customer operates under. Common mappings include:
- PCI DSS v4.0: requirements 6.3.2, 8.3.1, 11.4.1, 11.4.3, 11.4.5 with explicit segmentation testing evidence.
- SOC 2 (Trust Services Criteria): CC6.1, CC6.6, CC6.7, CC7.1, CC7.2 with control-by-control evidence packages.
- ISO 27001: Annex A.12, A.13, A.14, A.18 with finding-to-control mapping.
- HIPAA Security Rule: 164.308 (administrative), 164.310 (physical), 164.312 (technical) safeguard evidence.
- PIPEDA Schedule 1, Principle 7: evidence supporting reasonable safeguards on personal information.
- NIST CSF / CIS Controls: mapping to relevant subcategories where customers use these as their primary framework.
Engagements can be timed to specific audit windows. Where the engagement is the input to a SOC 2 Type II observation period or a PCI DSS annual assessment, the reporting schedule and evidence format are arranged to match the auditor's intake requirements.
Built For
Regulated Enterprise Environments.
The practice serves medium and large enterprises in financial services and fintech (payment processors, banking, brokerages), healthcare (covered entities and business associates handling PHI), SaaS and multi-tenant platforms (B2B and enterprise SaaS with regulated customer data), critical infrastructure (operators in energy, telecom, and transport), and cloud-first organisations running production workloads on AWS, Azure, or GCP.
Clients are based across Toronto, the Greater Toronto Area, Ontario, and Canada, with engagements in the United States. Industry detail is on the industries page.
Senior Hands
On the Keyboard.
Larger consulting firms operate on a leverage model. A senior partner sells the engagement, a manager scopes it, and one or more junior consultants execute the bulk of the testing. The model works at scale but it dilutes technical depth and adds communication layers between the customer and the people doing the actual work.
A boutique consultancy inverts that. The senior practitioner is the practitioner. There is no leverage to apply, which means engagement capacity is finite, but the depth and continuity benefit. Customers see fewer status meetings, fewer handoffs, fewer mis-translated findings, and faster turnaround when something needs a real-time decision. For regulated enterprises where engagement metadata itself is sensitive, fewer people on the engagement means a smaller confidentiality surface.
Frequently
Asked Questions.
Will testing impact production?
Most testing techniques are non-disruptive. Disruptive techniques (denial of service, destructive exploitation paths) are excluded by default and only run if explicitly requested and authorised in the ROE. Where a finding requires active exploitation to fully demonstrate impact, the testing window is coordinated with the customer. Operational disruption is treated as a contract-level concern, not a tester-discretion question.
How quickly are critical findings escalated?
Critical findings are escalated promptly after validation, through the out-of-band channel agreed in the rules of engagement, with timing defined in the engagement proposal. The escalation includes enough information for the customer's team to begin containment if needed, plus a follow-up note with reproduction steps and recommended immediate actions once the consultant has time to write them up.
How are credentials and captured data handled?
Credentials are exchanged through an agreed secure channel in accordance with the engagement's approved handling requirements. Handling requirements specific to your engagement are agreed during pre-engagement.
Do you support remediation validation?
Yes. Retesting and remediation validation may be included as part of an engagement or arranged separately, with the scope, timing, and applicable terms defined in the approved engagement proposal. The re-test validates each finding the customer reports as closed and updates the report with the closure evidence. The closure documentation is structured for the customer's auditor to consume directly.
How do you scope hybrid cloud environments?
Hybrid environments are scoped by mapping the identity boundary first (which accounts trust which, where federated identity crosses boundaries, what the cloud-to-on-prem connection path looks like) and then prioritising testing against the privilege-escalation and lateral-movement paths most likely to carry business impact. Hybrid engagements typically run longer than single-environment engagements because the cross-boundary paths take longer to enumerate properly.
Can testing align with compliance deadlines?
Yes. Engagements are routinely scheduled to align with PCI DSS annual assessment cycles, SOC 2 Type II observation periods, ISO 27001 surveillance audits, and HIPAA risk assessments. The reporting format and evidence packaging are arranged to match the auditor's intake requirements when this is known up front.
- What Is Penetration Testing? Complete Guide
- How Much Does Penetration Testing Cost?
- PIPEDA Penetration Testing Requirements
- OAuth 2.0 Security Flaws & Token Leakage
- Deserialization Attacks in Modern Frameworks
- AI Agent MCP Exploitation
- Adversarial ML: Evading Security Controls
- AI Model Supply Chain: Poisoned Models
- LLM Prompt Injection in Production Apps
- Kubernetes Exploitation: Pod Escape to Admin