Engagement activity
From lead to verified finding
Stages run in order. Leads are tested, the ones that hold up are re-proven, and the results land in your weekly report.
What you receive
Verified findings, attack paths, code findings and exposure alerts, in one portal and one written report every week.
What the subscription delivers
An annual subscription keeps your running systems, your code and your credentials under continuous watch. Engagement findings reach you only once they are proven, and everything is written up so your team knows what to fix first.
Verified findings, ranked
Ordered by real impact, each with its evidence, severity and remediation guidance.
Attack paths
How separate weaknesses chain together, and what each path puts at risk.
A report every week
One written report every week across all three areas, delivered in your client portal.
Throughout the year
Continuous assessment,
a report every week
Coverage
Across your authorized surface
Every discipline in your agreed scope, plus your connected repositories and daily dark-web monitoring.
Anatomy of a finding
Every verified finding
carries its own proof
A finding is more than a title and a score. Each one tells your team what is affected, how it was shown, what it puts at risk and how to close it.
What verified means
Re-proven independently. A separate verification step reproduces every engagement finding before it is reported. Nothing confirms its own result.
Leads stay out. An engagement lead that cannot be re-proven never reaches your report.
Evidence travels with it. Each verified finding keeps its evidence, severity, impact and remediation guidance together.
Code findings say which they are. A code finding is labeled flagged, or proven on the running application, so the two never blur.
Sample findingExample Corp
Customer records readable by any signed-in user
- Severity
- High
- Affected asset
- api.example.com, account API
- Status
- Verified
- Evidence
- The captured request and response that showed one account reading the record of another.
- Impact
- Any signed-in user could read the names, addresses and order history of other customers.
- Attack path
- EntryOpen self-service sign-up
- WeaknessMissing ownership check
- At riskCustomer account records
- Remediation
- Check on the server that the signed-in user owns each record they request, then add a test that covers it.
- In the code
- api/accounts/get.ts · line 48 · Fix pull request #489 ready
Illustrative sample on example.com. Not a real client finding.
The client portal
Your results,
in one place
Everything the subscription produces is delivered in the client portal: your posture at a glance, each engagement and its findings, your code findings, your dark-web exposures and the written report.
Sign-in is required, and each organization sees only its own data.
Posture at a glance
Verified findings, code findings and dark-web exposures, summarized on one dashboard.
Every engagement
Status and targets for each engagement, with its stages, coverage and attack paths.
Findings you can act on
Engagement findings reach the portal only once they are verified, grouped by severity, each with its remediation guidance.
The written report
Read each week’s written report once it is published, covering all three areas.
Code findings
Included in the subscription. Every commit and pull request in your connected repositories is checked, and each new issue is listed here as well as on the pull request. Each one says whether it is flagged or proven on your running application.
Each code finding shows
- The repository, file and line
- What raised it: a rule-based check or the AI review
- How severe it is
- What your policy did: warn, hold or block
- The suggested fix, and its pull request if there is one
- Flagged, or proven on the running application
Dark-web exposures
Included in the subscription. Every day we check new infostealer logs, breach dumps and dark-web posts for leaked accounts under your domains (your customers’ included), your key accounts and their passwords, and mentions of your company, then list every match in the portal so you can act on it.
Each exposure shows
- Where it appeared
- When it was found
- The affected identifier, masked
- The kinds of data exposed
- How severe it is
Start here
Put verified findings
in your team’s hands
Tell us what you want covered. We will agree the scope with you and report what we prove, with the evidence, every week.