No findings, no fee.

You choose the assets and access included in the audit. An external assessment can begin with approved public-facing assets. Cloud, internal, or authenticated testing requires separately agreed permissions. The report identifies any limits caused by unavailable access.

Before granting access, agree in writing on the data the assessment may use, any AI providers involved, retention and deletion terms, and how findings will be delivered. These terms belong in the engagement scope before testing begins.

No. If the agreed assessment finds no verified, actionable vulnerability, the audit fee is $0. You still receive a summary of the scope and assessment outcome.

It is the starting price for a focused audit. Larger asset counts, additional environments, and more complex testing receive a custom fixed quote before work begins.

Findings are rated Critical, High, Medium, or Low based on evidence, exploitability, potential impact, and the context of your environment. The report explains the reasoning and what to prioritize.

An audit is a point-in-time assessment within agreed boundaries. No findings means none were identified in that assessment; it does not guarantee that every vulnerability has been discovered.

The audit includes remediation guidance. Implementation and any follow-up testing are separate work unless explicitly included in your agreed scope.

Testing boundaries, permissions, and timing are agreed before work begins. Disruptive testing requires explicit authorization. Your engagement defines the permitted methods and stop conditions.