What to ask before you sign.

We test on staging by default, and go read-only on production only when the scope says so. Anything destructive runs on staging, with your written consent. We agree the stop conditions first.

You need a one-page consent and an NDA, both signed before anyone touches anything. We supply both templates, so legal reviews rather than drafts. The person who owns the product signs it.

We ask for the least access the scope requires, and we agree how you share it. Credentials rotate the minute the test ends, and we keep nothing about your systems. Never put a password in the brief.

You agree the scope in writing before testing starts. We test, and your report card lands within 72 hours. Retest Cybersecurity gets its own timeline.

The pricing page names the ways to work with us. We send back a fixed quote, and the number does not move once you accept it. Scope sets it, not a day rate.

A scan cannot tell a confirmed finding from noise. The security subject on your card is a scoped test, worked by testers and controlled agents. A senior reviewer confirms each finding by hand. Retest Cybersecurity is the separate, deeper contract.

If you need a certificate for an auditor, you need an accredited audit. A report card tells you what to fix. It does not certify you.

Testers are matched to your audience, so the confusion they hit is the confusion your customers hit. Devices find breakage, and controlled agents cover the rest. A senior reviewer signs the card.

Agents do test, and they work only inside the approved scope. A person reviews everything they return. Nothing reaches your card unreviewed.

We touch only what the scope names, and production stays read-only. Writes, deletes and load tests run on staging. The scope lists every host in writing.

Every confirmed finding carries the evidence behind it. The report card names the tested scope and its limitations. You can check the record.

The scope names the stop conditions before we start. You can pause for a release, a demo or an incident. Say stop and we stop.

You get one report card: every subject graded, every finding explained, every fix planned. The scope and its limitations sit on the same page. No PDF for the shared drive.

Every finding arrives with a fix plan, so your engineers can start the same day. Hands-on fix help is the Retest Cybersecurity contract, scoped separately. It is not a hidden line item.

A retest grades the same four subjects again, against the card you already have. You see what moved and what did not. A scan forgets the last run.

The same four subjects every time, so one release reads against the last. You see which findings closed and which came back. The card names the tested scope.

The card goes to you under NDA, and you decide who reads it next. It is written for the board and the engineer in the same language. We publish nothing.

The written scope decides which of the six your engagement covers. Security is graded first.

• Web app pentest — OWASP Top 10
• API & auth abuse — sessions, tokens, IDOR
• Cloud & infra config — buckets, headers, TLS, secrets
• Data exposure & privacy — PII leaks, logs, backups
• Supply chain — dependencies, CI, third-party scripts
• AI & LLM attack surface — prompt injection, tool abuse

A separate contract, not included by default: a deeper third-party security test, then hands-on help with the fixes. Scoped in writing, with its own timeline and your written consent. Nothing starts until you sign.

A senior reviewer reproduces each candidate finding and decides whether it is real. A person's name is on that call, not a confidence score. Tools propose, a reviewer signs.

AI and LLM surfaces are one of the six sub-categories: prompt injection, tool abuse, retrieval boundaries. We test them wherever your product talks to a model. The scope names which surfaces are in.

We are a small team in Asia and we work remotely. The written scope decides where we test. Your product can sit anywhere.

An NDA and a one-page consent go out with the scope, before anyone touches anything. Send yours instead if you prefer, and we sign once we agree it. Nothing starts before the signatures.

We never test outside the agreed scope, and we never keep anything about your systems. We never publish your name or your findings. We never promise you are secure.