Method

Scope first. Evidence second.

Offensive security engages both the client's and the provider's liability. Our method makes every action authorised, traceable and actionable.

1. Scope

Objectives, assets, exclusions, window, contacts, stop criteria. The RoE is signed, hashed and acknowledged.

2. Test

Reconnaissance, manual analysis, bounded tooling. Every command is checked against the scope.

3. Prove

Triaged findings, reproducible evidence, CVSS, ATT&CK, remediation and FR/EN report.

4. Fix

Debrief, retest and remediation tracking. The client keeps control of closure.

Scope

What we refuse to blur

A pentest without a scope is an incident waiting to happen. Before the first request we formalise:

  • Authorised targets, exclusions and third parties to avoid.
  • Time window, maximum rate and emergency contacts.
  • Data allowed to be accessed and retention policy.
  • Immediate stop criteria and kill switch.
  • Contract reference and authorised signatory.

Evidence and integrity

Every command, output and artefact is timestamped and hashed. The report includes the audit-chain head.

  • SHA-256 per evidence file.
  • Chained, verifiable audit log.
  • Invite-only client access with MFA.
  • Signed, logged download URLs.

Integrity is not a legal signature: for contractual needs, anchor the head in an external system.

Compliance

NIS 2, DORA, CSSF: evidence, not slogans

NIS 2

Governance, risk management, 24-hour incident notification. Documented tests and retests are useful evidence.

DORA

Operational resilience, testing, TLPT. TIBER-EU is the reference framework; purple teaming is required in the DORA-aligned version.

CSSF

ICT and security risk management expectations. We produce findings and action plans, not a compliance attestation.

Clear limit. Sodew is not a certification body or regulator. A Sodew report is not NIS 2, DORA or ISO 27001 certification.

Unsure about your scope?

We help define it before talking about tools.

Contact Sodew