Step 1 · The request
What is being asked for.
What we do, in detail
Authorisation, scope, third-party systems, and IT services.
Program 01 · Not inferred
Authorisation first
Authorisation is obtained in writing before any access, and is never inferred from a verbal request, an existing support contract, or the fact that someone handed over credentials. It also has to come from a person entitled to give it: a keen contact inside a business is not necessarily able to authorise testing of their employer's infrastructure. Establishing that is our job rather than theirs, and it occasionally slows a start by a day.
Step 2 · The authority
Who can actually authorise it.
Step 3 · The document
Signed before anything starts.
Step 4 · The access
Only then.
Step 1 · The list
What is in, named explicitly.
Step 2 · The window
When testing may occur.
Step 3 · The discovery
Reported, not pursued.
Step 4 · The extension
Agreed before, if at all.
Program 02 · Not a suggestion
Scope as a boundary
The agreed scope is the limit of the authorisation, which means activity outside it is unauthorised even though the engagement itself is authorised. So scope creep here is not a contractual irritation to be sorted out later, it is a step outside the thing making the work lawful. Assets discovered mid-engagement are reported rather than explored, and testing extends to them only after a written extension agreed in advance.
Program 03 · Your client cannot consent
Third-party systems
Where systems sit on infrastructure operated by somebody else, a client often cannot validly authorise testing of it, because it is not theirs to authorise. We require the consent of the party entitled to give it and compliance with whatever testing policy that party imposes. This gets skipped constantly, usually in good faith, and it is the most common way an otherwise careful engagement ends up unauthorised in part.
Step 1 · The estate
What sits where, and whose it is.
Step 2 · The owner
Who may actually authorise.
Step 3 · The policy
What the provider permits.
Step 4 · The decision
Included, or carved out.
Step 1 · The need
What actually has to happen.
Step 2 · The access
Defined and authorised.
Step 3 · The work
Within what was agreed.
Step 4 · The handover
Reported, with access closed.
Program 04 · Ordinary work too
IT services
Not all of this work is assessment. Ordinary technology services run on the same discipline about access: what we may touch, when and on whose authority. Where we process personal data on your behalf we act as your processor under a written agreement and you remain the controller. Findings go to you and are not published or passed on, and credentials encountered are handled only as the work requires.
Got something that needs looking at properly?
A free first conversation, with no obligation.