Realistic testing, under your control.

Authorisation

Before any activity, a client representative with authority over all in-scope systems signs a written authorisation. Where assets are operated by third parties, such as hosting or cloud providers, we confirm the permissions needed before they are included.

Scope and exclusions

Scope is defined in writing: the objectives, the systems and groups of people included, and the time windows for activity. Unless you explicitly agree otherwise, the following are always excluded:

• Activity that could disrupt live services or availability.
• Destructive actions, or changes to production data.
• Accessing more data than is needed to demonstrate impact.
• Personal accounts and personal devices of your staff.
• Any third party that has not given permission.

Safety controls

• Emergency stop. Named contacts on both sides are reachable throughout. Either party can pause the exercise at any time; we stop immediately and confirm in writing.
• Control group. A small group of your senior stakeholders knows the exercise is running, so it stays realistic while remaining fully overseen.
• Deconfliction. If your team detects activity, the control group can confirm with us straight away whether it is part of the exercise, so a real incident is never mistaken for a test.

Communication

The engagement opens with a kickoff, and you receive status updates weekly. Any finding that presents a serious, immediate risk is reported to your nominated contact straight away rather than held for the final report.

Reporting and debrief

You receive an executive report for leadership and a technical report for your security team, followed by separate debrief sessions for each audience. See what a report contains.

Retesting

One retest within 90 days of the final report is included, to confirm that fixes are effective.

Duration

Typical engagements run two to six weeks. The exact timeline depends on your objectives and size, and is agreed during scoping before any work begins.

Request a scoping call →