Audit methodology
How we test, what we record, and what you get. Seven phases, honest evidence, reproducibility and a retest.
How an audit works
Seven phases, each feeding the next — from agreeing the scope to an evidence-based report and retest.
- 1Scope & authorizationBoundaries, authorization, standard
- 2ReconnaissanceAttack-surface map
- 3Threat modelingWhat we test and why, by risk
- 4Vulnerability analysisFind vulnerabilities and weak spots
- 5ExploitationSafely validate the findings
- 6Post-exploitation & impactTranslate into business impact
- 7Reporting & retestEvidence and a verification retest
What we test
Web & API
Applications, APIs, authentication, access logic (OWASP ASVS/WSTG, API Top 10).
Network
External and internal perimeter, segmentation, services and configs.
Mobile
Android/iOS apps and their backend (OWASP MASTG).
Cloud & configuration
Azure/AWS, IAM, storage, baselines (CIS Benchmarks).
What you get
Risk-prioritised findings
Severity and business impact, not just a list.
Reproducible evidence
Steps, requests/responses, artifacts — every finding can be reproduced.
Actionable fixes
Concrete steps with references to a standard / best practice.
Retest
We verify that a finding is actually closed.
Standard gap analysis
On request — ISO/PCI/SOC 2 mapping as a matrix.
Compliance & certification
We prepare you for certification (ISO 27001 / PCI DSS / SOC 2): we provide the evidence base and close the findings. The certificate itself is issued by an authorized body — we do not issue it.
Let’s discuss your case
Tell us what you need to test or protect — we’ll propose a clear scope of work and the next step.