Assessment
A controlled examination
of your estate.
Not a demonstration, and not self-service. Assessment is available to institutions whose request has been approved and whose documentation is complete.
What it covers
Endpoint surface
Every managed and unmanaged device we are given scope over: what runs, what persists, and what can execute without anyone noticing.
Identity and access
Where privilege has quietly accumulated, which accounts could act as an adversary would, and what the blast radius of one of them actually is.
Exposure
What your estate presents outward, and how much of that you already knew about.
Configuration drift
The distance between the policy you believe is enforced and the policy your machines are running today.
What you receive
Findings arrive with the evidence they came from.
A written scope, agreed before anything runs
Which systems, which window, which techniques. Nothing outside it is touched, and the engagement can be stopped or revoked by you at any point.
Findings with the evidence they came from
Each one records what was observed, why it matters to you specifically, and the remediation. A CVE is cited only where one genuinely applies, and left out rather than guessed.
Ranking by reachability, not by database severity
What an adversary can actually get to from where they actually are, ahead of what scores highest in a public table.
An executive summary an accountable person can read
Written for the person who has to decide what to fund, in language that does not require them to be an engineer.
A remediation sequence
Ordered by what reduces exposure first, with an honest note where a fix is structural rather than a setting.
A direct line to the engineer who ran it
Findings are defended in conversation. You can ask how something was established and get the reproduction.
What you will not receive: a compliance certificate, a single-number security score, or a finding count promised before the work is done. An assessment that guarantees its own conclusions is not an assessment.
How an engagement proceeds
Request
You describe the estate and the concern. No budget field and no qualification call.
Technical review
An engineer reads it and judges whether we are the right people. Where we are not, we say so and say why.
Scope and authorisation
The scope is written down and you authorise it in writing. This is the legal basis that permits us to act inside your estate.
Quotation
Priced against the agreed scope. Issued on request — there is no published rate card, because there is no standard estate.
Execution
Carried out by our own engineers, under your authorisation, with the ability to stop it at any moment.
Findings and decision
Delivered, defended, and discussed. Whether anything follows is a separate decision, made afterwards.
Commercial terms
Quoted against scope.
There is no published rate card. An assessment is priced against the scope you and we agree in writing — the number of systems, the depth, the constraints your jurisdiction imposes and the window it has to run in. A figure quoted before any of that is known would be either wrong or padded.
A quotation is issued on request, against a written scope, before any work begins. Nothing is charged for the technical review that decides whether we are the right people.
Assessment is granted, not purchased. Where we are not the right people, we say so — and there is no invoice attached to that answer.
Begin with the estate you actually have.
Describe the estate in general terms only. Do not send vulnerability detail, credentials, address inventories or anything confidential through a web form — once scope is agreed, we establish a channel appropriate to the material.