1. 01

   Define scope

   Goals, systems and rules — in writing, under NDA.

2. 02

   Test

   Manual and automated, like a real attacker.

3. 03

   Report

   Executive summary and a prioritised fix plan.

4. 04

   Retest

   We confirm every issue is closed.