Skip to content
Ryan Henrick
MenuClose

Engagements

Seven steps.Nothing is tested before step 3 is signed.

  1. 01

    Outreach

    You send a message through the contact form or email. Tell me what you run and what you want checked.

    If I see a problem on a system I do not have permission to test, I will not test it. See my disclosure policy.

  2. 02

    Scoping

    A short call or email thread. We agree:

    • Which domains, IP ranges, apps, APIs and cloud accounts are in scope.
    • What is out of scope, and which actions are off limits.
    • The test window and request limits.
    • Who on your side can approve changes and who to call if something breaks.
    • Whether you want a report only, or a report and fixes.

    I then send a written quote. Quote only; the price depends on scope.

  3. 03

    Signed authorization and scope

    You sign a written authorization naming the systems I may test, the dates and the rules. If the systems are hosted by someone else (a cloud provider, an agency, a vendor), the owner must be able to authorize that part, and some providers need their own notice.

    A system not named in the signed scope is not tested, even if I find it along the way.

    I do not start without this. Testing a system without permission is a crime in most countries.

  4. 04

    Testing

    I work only inside the signed scope and window.

    • Discovery of what is exposed, from public sources first.
    • Unauthenticated testing.
    • Signed-in testing with test accounts, including checks between accounts and organizations.
    • Evidence is saved as I go. If I find something serious (for example exposed credentials or customer data), I stop collecting it and tell you straight away, without waiting for the report.
  5. 05

    Report

    You get a written report. Each finding has steps to reproduce, evidence, impact and a recommended fix, and the report lists what was not tested. I walk your team through it if you want.

    See a sample report

  6. 06

    Fix

    Two options:

    • Your engineers fix. I answer questions and check proposed changes.
    • I fix. Scoped and quoted separately, done in your repository or accounts under the same authorization process.
  7. 07

    Retest

    I repeat each original test after the fix and check nearby areas. The report is updated with a status per finding: fixed, not fixed, or could not be verified, with the reason.

Data and confidentiality

  • Findings and evidence go only to the people you name.
  • Test accounts and data are labeled and listed in the report so you can remove them.
  • Credentials are never put in reports.

Tell me what you run and what worries you.I reply with questions and a quote.

Request a scoping call