Thinking about working with us? Here’s exactly what happens, day by day — no black boxes, no surprises on the invoice.
- Days 1–2
01
Scope
A working session, not a questionnaire — map assets, agree rules of engagement, set emergency contacts and blast-radius limits.
You receive: Statement of work · Rules of engagement · Asset inventory · Emergency runbook
- Days 2–3
02
Reconnaissance
Passive intel first — OSINT, certificate transparency, leaked credentials — then active mapping. Often reveals shadow assets.
You receive: Attack-surface map · Exposure brief · Tech-stack profile
- Days 3–5
03
Vulnerability identification
Hybrid manual and automated discovery. An engineer triages every finding against your environment — false positives die here.
You receive: Triaged findings list · Coverage report · Risk pre-rating
- Days 5–7
04
Exploitation
Validate every finding with a safe proof of concept. Where chains exist, we build them end to end.
You receive: Validated PoCs · Attack-path graph · Impact analysis
- Days 7–10
05
Report & remediate
Two reports — executive and engineering. After you fix, we retest every critical and high finding at no additional cost.
You receive: Executive report · Engineering report · Remediation matrix · Retest pass
Before we start
A short scoping call to agree goals, systems in scope, testing windows and contacts. You receive a statement of work and signed rules of engagement — no surprises later.
While we test
We map your attack surface, run automated checks for coverage, then test by hand. Anything critical is shared with you immediately, not saved for the final report.
After we report
You get an executive report and an engineering report, a walkthrough with your developers, and a free retest of fixed critical and high findings — followed by an attestation letter.
Who you will talk to
You get a single point of contact for the whole engagement and direct access to the security engineers doing the work — not a ticketing system or a sales team in the middle.
How we keep you informed
We agree how often you want updates — daily notes, a mid-point call, or just the final report — and we always call you straight away if we find something critical.
How our team helps
- 01Agree scope and rules of engagement in writing
- 02Test with automation plus hands-on work
- 03Report critical issues straight away
- 04Deliver two reports, a walkthrough and a free retest
- 05Assign one point of contact for the engagement
- 06Give updates at the frequency you choose
- 07Stay available for questions after delivery
Questions about any step? Message us on WhatsApp — a consultant will reply, not a bot.
— The CRIS InfoTech security team