Scope.
Define the assets, authorization, constraints and stop conditions before touching a system.
The output
A written boundary for the work.
BLACKOPS / The approachA precise question.
A precise question.
A defensible conclusion.
Security work should be understandable before, during and after the engagement. We agree the boundary, investigate with care and distinguish evidence from assumption.
Investigate.
Follow the highest-value questions. Validate behavior with controlled tests and the minimum necessary evidence.
The output
Findings with context, impact and limitations.
Engineer.
Work through the fix with your team. Connect a finding to an understandable implementation change.
The output
A prioritized, reviewable remediation plan.
Verify.
Retest agreed changes and document what was covered, what remains and who owns the next step.
The output
Verification evidence and a clear handover.
Before active testingPermission is
Permission is
part of the design.
No scope expands itself. Newly discovered systems, identities or data are questions for the owner, not permission to keep exploring.
The working agreement includes
- Authorized owner, exact assets and excluded dependencies.
- Permitted techniques, test windows and request limits.
- Stop conditions, escalation contact and resume authority.
- Evidence handling, retention and reporting expectations.
- Coverage limitations, remediation and retest arrangements.
Start with the right question
Discuss an engagementA difficult question deserves a precise answer.
Bring the system, the concern and the boundary you want to examine.