Authorised, in scope, every time
No testing starts until the scope is agreed in writing and your authorising signatory has approved it. Our tooling enforces that scope technically: targets outside it are refused, and the refusal is recorded.
Honest coverage
Automated tools fail quietly. A scanner that can’t reach a target, or a check that is missing a dependency, often just returns nothing, and “nothing” looks like a clean result. We treat that as a problem. If a check couldn’t run, your report names it in a Scan Coverage section and explains why, so you always know what was tested and what wasn’t.
Retests that tell the truth
When we retest, every original finding is placed in one of a few clear categories: unchanged, changed, new, resolved, not retested, or newly covered. A finding is only marked resolved when we’ve actually retested it and confirmed the fix. Anything we couldn’t retest is labelled as such, never counted as fixed.
De-duplicated, triaged findings
Findings are de-duplicated across tools and across repeat scans, so the same issue never appears three times. Findings you’ve accepted, confirmed as false positives or fixed are tracked through their life, and any regression is flagged.
Clear, proportionate reporting
Low-value informational observations are summarised separately, so they don’t bury the issues that matter or inflate your risk score. Leadership gets a concise executive summary. Your technical team gets reproducible detail.