Services / Authorized work
Choose the question you need answered, then agree the systems, methods, evidence, and deliverables. Product evaluation and security services are separate engagement paths.
The outputs below are proposed scoping options, not a universal package or a promise that every item is included. The written engagement defines the actual deliverables.
Validate an explicitly approved security objective through scoped testing.
Proposed outputs: Rules of engagement; documented observations and supporting evidence; prioritized findings and a closeout discussion.
Scope to agree: Targets, permitted techniques, exclusions, window, stop authority, and any retest.
Decide whether a field-appliance assessment model fits the environment.
Proposed outputs: Fit/gap review; deployment assumptions; evidence requests; a proposed acceptance plan.
Scope to agree: Locations, hardware, connectivity, operators, acceptance owner, and support scope.
Review trust boundaries and security decisions before or during a change.
Proposed outputs: Annotated boundary review; assumptions and risks; recommended design decisions.
Scope to agree: Systems and diagrams available, stakeholders, change scope, and review depth.
Identify and contextualize weaknesses in approved systems.
Proposed outputs: Coverage record; triaged observations; prioritization rationale and validation limits.
Scope to agree: Asset inventory, allowed checks, authentication, exclusions, and false-positive review.
Test whether a defined operating or recovery procedure is usable.
Proposed outputs: Exercise plan; observed timeline; deviations; corrective actions and owners.
Scope to agree: Scenario, safety constraints, observers, recovery baseline, and return-to-service authority.
Develop capability around a defined defensive question.
Proposed outputs: Agreed research notes or instructional material; practical exercises; limitations and follow-up topics.
Scope to agree: Audience, prerequisites, authorized lab, learning objectives, and reusable material.
Confirm the owner, objective, environment, constraints, deliverables, and commercial terms. Testing requires written authorization before activity begins.
Work within the approved boundaries. Record material deviations, use the agreed escalation path, and obtain approval before expanding scope.
Separate observations from assumptions. Agree next actions, confirm remaining access and data handling, and identify any separately scoped validation.
| Driver | Why it matters | Bring this information |
|---|---|---|
| Coverage | More systems, locations, or trust boundaries change the work required. | Approximate asset types and locations—not secrets or target credentials. |
| Depth | Architecture review, authenticated assessment, and hands-on validation are different activities. | The decision you need to make and the evidence needed to support it. |
| Access and scheduling | Restricted windows, approvals, and travel or placement arrangements affect sequencing. | Known deadlines, allowed windows, and local availability. |
| Deliverables and follow-up | Workshops, report formats, training, recovery exercises, and retesting need an agreed scope. | Required outputs, reviewers, procurement conditions, and support expectations. |
There is no public fixed-price package, standard evaluation duration, or included support commitment. Fees, equipment arrangements, scheduling, and follow-up must be confirmed in writing before work starts.