Tool
Security assessment planner
Choose the service and the questions change to fit it. At the end, a security consultant receives a structured summary of your environment and goals, and you get a copy. It is a starting point for a scoping conversation, not a quote.
Plan your assessment
Please do not enter credentials, keys, customer data or complete host lists. We ask for those later, through a secure channel, after scope and authorization are agreed.
What the planner asks about
- Web applications: how many, which roles, how users sign in, the technology and the test environment.
- APIs: size, documentation, authentication and whether the platform is multi-tenant.
- Internal networks: segments, hosts, directory services, locations and what to avoid.
- External networks: public addresses, domains and whether you have an inventory.
- Cloud: provider, accounts, workloads, identity and production limits.
- Vulnerability assessment, red team, AI systems and detection work, each with its own questions.
Before any testing
What we need from you
Written authorization from someone who can grant it.
- A signed scope and rules of engagement
- Named contacts and an emergency contact during testing
- A test window, and systems or hours to avoid
- Notice to any third party that hosts the systems, where their terms require it
What the planner is not
A conversation starter.
- Not a quote or a proposal
- Not a promise of what testing will find
- Not authorization to test anything
- Not a scan: it never contacts your systems
Questions people ask
Does the planner scan my systems?
No. It is a form. It never contacts anything you name in it.
What happens with my answers?
They go to our security team so they can prepare for a scoping conversation. We keep them for up to 24 months unless you ask us to delete them sooner. See the privacy policy.
Is there a charge for scoping?
We do not charge for the first scoping conversation. We do not publish a price list, because the effort depends on what is in scope. Pricing comes from the scope.
Can I use it for a system I do not own?
No. We only test systems when someone who has authority over them agrees in writing.
I am not sure which service I need.
Choose Not sure yet on the first step and describe what you are worried about. Or try the service finder.
Related
-
Request a security assessment
Tell us what you need tested, fixed or investigated. For an active attack, call us.
-
Find the right security service
Five questions point you to the security services most likely to fit, with the reasons.
-
Sample penetration test report
A complete, invented example of a web and API penetration test report: summary, scope, method, findings with evidence, fixes and retest.
Tell us which of these is you
I need a technology project delivered
Describe the system, the change and the timeline. A technical lead replies to talk about scope.
Discuss a projectI need to hire technical talent
Send the role, headcount and start date. A recruiter confirms the details before sourcing starts.
Request talentMy systems may be at risk
Ask for an assessment, a penetration test or help fixing findings. Under attack now? Call.
Speak with a security expert