Security Center
Methodology
How we test, start to finish.
A good security assessment is a process, not a scan with a logo on it. Here is ours, stage by stage. Every engagement is authorised in writing, evidence-led, and stops short of anything destructive.
Stage 01 of 09
Reconnaissance
Understand what you expose before touching anything.
- Confirm written scope and rules of engagement, so everything is authorised.
- Map the publicly visible surface from the outside, the way anyone could.
- Note the technologies and services in use.
What you get
An authorised scope and a clear picture of your external footprint.
Recognised frameworks
The standards behind the method.
The same public frameworks international security teams and auditors use, so your report reads the way your board, your insurer or a foreign partner expects.
- OWASP Web Security Testing Guide
- The test cases behind web application testing: authentication, sessions, access control, input handling and business logic.
- OWASP ASVS and API Security Top 10
- Sets how deep each part of a web app or API is verified, agreed with you at scoping.
- OWASP MASVS
- The baseline for Android and iOS app testing: storage, network traffic, authentication and platform use.
- PTES and NIST SP 800-115
- The shape of an engagement: scoping, reconnaissance, testing, analysis and reporting, in a repeatable order.
- CVSS
- A standard severity score for every finding, read alongside what it would cost your business, so fixes are ranked by real risk.
- Cyber and Data Protection Act 2021
- Zimbabwe's data protection law, used to flag findings that put personal data, and your obligations, at risk.
Want this run against your systems?
Start with a free passive scan that touches nothing, or scope a full, authorised test.