I deliver what I exploited, not what a scanner flagged. Every finding in the report carries proof that it works, the exact conditions under which it works, and its real impact on your specific environment.
The industry has normalised delivering scanner output in an attractive template. The result is a hundred-and-fifty-page report with forty criticals that your team cannot prioritise, because nobody checked which of them are actually reachable. I work the other way round.
Almost every engagement combines at least two. An external assessment without the internal component leaves the question your board will ask unanswered: what happens once someone is inside?
Everything your organisation publishes on the internet, including what it does not know it publishes: forgotten services, staging environments, orphaned subdomains and credentials leaked in repositories and public dumps.
Manual OWASP-guided review of business logic, horizontal and vertical access control, session management and frontend supply chain. Broken logic is invisible to every tool on the market.
From a compromised employee or workstation position: Kerberoasting, ADCS certificate template abuse, authentication coercion, unconstrained and constrained delegation, credentials in attributes and complete paths to domain administrator.
Identity configuration, effective versus assigned permissions, cross-subscription escalation paths and secret exposure in deployment pipelines.
Five phases, in this order. It is the real sequence of an engagement, not a graphic device: nothing starts until phase 01 is signed.
In-scope and out-of-scope assets, execution windows, stop criteria and signed authorisation.
OSINT, enumeration and a comparison of documented surface against real surface.
Manually verified access. Without exploitation there is no confirmed finding.
Escalation, lateral movement, persistence and maximum demonstrable reach.
Delivery, technical session, board session and verification of remediations.
It depends on asset count, engagement type and whether the internal network is in scope. As an order of magnitude in the Spanish market, an external assessment of a small company with few published assets starts in the low thousands of euros; a full internal assessment of a mid-sized corporate domain sits in the tens of thousands. I give you a fixed figure after a thirty-minute conversation, not an hourly rate against an undefined scope.
Grey box is the most efficient option in most engagements: it starts from a compromised employee or supplier position and goes straight for depth without spending budget on reconnaissance. Black box measures real exposure and is the right choice when the perimeter itself is the question. White box, with access to design and source, gives maximum coverage per euro when the goal is to fix or certify rather than to measure detection.
Techniques carrying an availability risk — denial of service, memory-corruption exploitation against critical services, large-scale brute force — are excluded by default and only executed with explicit authorisation within an agreed window. Stop criteria are written into the rules of engagement before anything is touched.
Always, and it is not an add-on. Without the second pass an intrusion report is a document, not a security improvement. Remediation verification runs within three months of delivery and ends with a closure record you can present to an auditor or a client.
Describe the environment and the reason behind the engagement. I will reply with the recommended mode and an estimated order of effort.