Question 1

Is the retest really included?

Accepted Answer

Yes, in the original fee. Verifying remediation is part of the engagement rather than a follow-on sale.

Question 2

Who are findings written for?

Accepted Answer

The person who has to fix them, with a named owner and the evidence needed to reproduce the issue.

Question 3

Do you sell security products?

Accepted Answer

No. We hold no reseller relationships, partner tiers or referral arrangements with any vendor.

Question 4

How is severity decided?

Accepted Answer

By realistic exploitability in your environment, not theoretical worst case, with the reasoning stated.

Question 5

What if you cannot test something?

Accepted Answer

It is named at the front of the report with the reason, rather than left to look like a clean result.

Question 6

Are fees charged per finding?

Accepted Answer

Never. Fixed fees against scope, because per-finding pricing rewards inflating severity.

Question 7

Can you support compliance work?

Accepted Answer

Yes, including CMMC, HIPAA, PCI and cyber insurance evidence, with required and optional clearly separated.

Question 8

Do you work with our existing IT provider?

Accepted Answer

Routinely. Findings are written so their engineers can act without translation.

Not found