Formal scopes with severity tiers
Every target classified and every severity band priced before testing begins, so expectations are agreed up front.
Expert-led
Penetration testing as a service
Structured engagements, not an open call
Certified testers, formal scope, documented rules of engagement and an evidence trail built for review. Continuous or scheduled depth, delivered as fixed-scope, tiered or subscription engagements.
Dedicated tester pools, SLA response guarantees and custom severity scoring are Enterprise-tier; VPN access, source code review, retesting and compliance exports are Professional-tier.
Platform viewLive
- Evidence filesencrypted
- Malware scanclean
- Accessleast privilege
- Audit trailrecorded
Depth that a bounty alone cannot provide
Expert-led engagements answer the questions that continuous crowd testing does not: depth, coverage evidence and defensible assurance.
- Staffing model
- Named testers
- Scope and RoE
- Documented
- Retest loops
- Verified
- Effort tracking
- Metered
Engagements staff to specific people rather than an anonymous pool.
Boundaries, prohibited techniques and testing windows agreed before access.
Closure depends on a reproduced fix, not on a status change.
Consumed effort is visible to both sides during the engagement.
Engagement depth
What a formal engagement includes
Everything needed to plan, run and evidence an expert assessment — on one record.
Rules of engagement
Testing boundaries documented and enforced rather than assumed, with acceptance recorded per tester.
NDA and credential locker
Confidentiality tracked per expert, and testing credentials distributed under control instead of over email.
VPN tester connectivity
Secure tester access to internal systems, provisioned for the engagement window and revoked when it closes.
Source code review
White-box analysis alongside black-box testing where a repository is in scope.
Retesting and verification
Confirm that a fix actually closed the finding, with regression checks on related components.
Certification artifacts
Attestation output for stakeholders and auditors, tied to the engagement record.
Compliance report exports
Evidence formatted for the obligation in question rather than reworked by hand afterwards.
Risk scoring and attack paths
Prioritisation by realistic exploitability, not raw severity in isolation.
Engagement mechanics
The commercial and operational details that usually get asked early.
- Engagement models
- Fixed-scope assessment, tiered packages, or subscription with a named team.
- Access model
- Expert role + organisation entitlement + accepted invitation, all three required.
- Confidentiality
- NDA acceptance recorded per tester before any access is granted.
- Reporting
- Structured findings with reproduction, evidence and remediation guidance.
- Movement reporting
- Delta and regression view between cycles: new, resolved, recurring, carried over.
- Billing
- Generated from metering and engagement records, with pre-agreed overage treatment.
Lifecycle
How an engagement runs
Planning, staffing, testing, retest and closure on one timeline.
- 01
Plan
Assets classified and tiered, model chosen, rules of engagement and success criteria agreed.
- 02
Staff
Named testers scheduled against the window, with entitlement and invitation checks enforced.
- 03
Provision access
NDA acceptance recorded, credentials released through the locker, VPN access opened.
- 04
Test
Black-box and white-box testing within scope, with progress visible to both sides.
- 05
Report
Findings normalised, scored and evidenced, with compliance exports where required.
- 06
Retest and certify
Fixes verified, certification produced, then metered effort and the invoice reconciled.
Commercial models
Three ways to buy expert depth
Every model runs on the same platform with the same evidence trail. The difference is how effort and coverage are committed.
Fixed-scope assessment
Defined per engagementone-off
A bounded assessment of a defined set of targets, usually tied to a release, audit or launch.
- Scoped targets with severity tiers
- Rules of engagement and NDA
- Structured findings and remediation guidance
- Retest of validated findings
Tiered packages
Most commonPriced by tierper cycle
Repeatable coverage at increasing depth, with severity bands and overage thresholds agreed in advance.
- Everything in a fixed-scope assessment
- Delta and regression reporting between cycles
- Compliance report exports
- Pre-agreed overage treatment
Subscription
EnterpriseCommitted allocationongoing
Continuous expert coverage with a named team that knows your environment, metered against an agreed allocation.
- Everything in tiered packages
- Dedicated tester pool for continuityEnterprise
- Contracted SLA response guaranteesEnterprise
- Custom severity scoringEnterprise
Plan availability: dedicated tester pools, SLA response guarantees and custom severity scoring are Enterprise-tier. VPN access, source code review, retesting and compliance exports are Professional-tier. Confirm the mapping against the Service Catalog before quoting.
Documentation
The detail behind an engagement
PTaaS engagement lifecycle
Planning, staffing, testing, retest, certification and billing, end to end.
Read the docScope and rules of engagement
How targets are classified and boundaries enforced.
Read the docRemediation and verification
Proof of fix, retest loops and delta reporting.
Read the docCommon questions
Engagement questions we hear most
How is this different from buying a pentest?
The work is comparable; the operating model is not. Scope, rules of engagement, access, findings, retest evidence, certification and billing live on one record, so the next cycle starts from the last one instead of from a document.
Who gets access to our environment?
Only testers who hold the expert role, are covered by your entitlement and have accepted the engagement invitation. NDA acceptance is recorded, credentials are released through the credential locker, and access expires with the engagement window.
What happens if a fix does not work?
The finding returns to remediation with the new retest evidence attached. State and history are preserved rather than restarted, which is what makes recurring findings visible as a pattern.
Can we combine expert testing with a bounty program?
Yes, and most mature programs do. Both read the same scope definition, so targets are covered by both models without duplicating definitions or reporting.
Scope an engagement against your real attack surface.
Tell us what has to be assessed and what evidence your stakeholders need. We will come back with a scope, a tier structure and a timeline.