How we work
No black box. Here's exactly what happens, step by step.
You should know what you're buying before you buy it. This is how every Smart VAPT engagement runs, from first email to final retest.
The engagement
- 01Scoping call
A 15-minute call with your tester about goals, systems and deadlines.
- 02Fixed quote and scope
A written scope and fixed price within three working days.
- 03Paperwork
Mutual NDA, signed authorisation letter, and agreed rules of engagement.
- 04Testing
In or outside office hours. Critical issues are reported immediately.
- 05Report
Written by your tester and delivered through an encrypted channel.
- 06Debrief call
A walkthrough for your technical team and, if you like, leadership.
- 07Retest
Once you've fixed things, we verify the fixes. Free within 90 days.
- 08Data deleted
Test data is securely destroyed after the agreed retention period.
Methodology
Manual-first testing, guided by recognised industry frameworks. Tools help us cover ground; they never replace the tester's judgement.
- PTESOverall engagement structure
- OWASP WSTG & API Security Top 10Web and API testing
- OWASP MASTGMobile application testing
- MITRE ATT&CKMapping attacker techniques
Our terms, in plain English
The quote is the price. No day-rate overruns.
One retest within 90 days of the report.
Plans change. Moving your test dates costs nothing.
Evenings or weekends, if that protects your operations.
How we handle your data
A security test gives us a privileged view of your business. We treat it that way.
- Findings and evidence stored encrypted at rest
- Reports delivered through an encrypted channel, never as plain email attachments
- Data deleted after the agreed retention period
Know exactly what your test will cost by tomorrow
Tell us what you need tested. You'll get questions or a fixed quote within three working days.