How an AAVETech engagement runs
Key takeaways
- Nothing is tested before the scope and the authorisation are signed by both sides.
- You get a live finding log during the engagement, not only a report at the end.
- The report serves two audiences: your engineers, and whoever signs off on the risk.
- The retest is included, and it names which findings remain open.
The six stages
01 · Scoping call
Thirty minutes on the phone, and a look at your estate if we need one. The output is a written scope and a fixed price band, before anything is agreed to.
02 · Authorisation and rules of engagement
A document naming every system in scope, every date, the test window, your technical contact, the emergency stop word, and what is explicitly excluded. Both sides sign it. Both keep a copy.
03 · Testing
Manual and AI-assisted testing inside the agreed window. You get a live finding log, so your team can start fixing things before the report is finished.
04 · Reporting
A technical report with reproduction steps, evidence, CVSS scoring and a business-impact note for every finding, plus a one-page summary for a board or a client.
05 · Remediation support
Your team fixes the findings. We answer questions while they do it, and re-review the fixes where the design is unusual.
06 · Retest
We re-test what we raised and issue a retest certificate listing every finding as closed, partial or still open. This is included, not sold as an extra.
Why the authorisation step is not optional
Testing a system without written authority is a criminal offence under Section 43 of the Information Technology Act, 2000, and it is also a very effective way for a business to create a legal problem instead of solving a security one. It also puts the tester at risk, because the system owner has no obligation to stop you and no reason to.
The rules-of-engagement document removes all of that ambiguity. It defines what may be tested, when, by whom, and what happens if something goes wrong. It also gives your own legal, insurance and compliance teams the evidence they need to approve the work.
What we do not do
- No testing outside the agreed scope, even where we find something serious and want to look closer.
- No destructive testing unless you explicitly request it in writing as part of the scope.
- No access to systems, accounts or devices you do not own or control.
- No data exfiltration and no retention of client data after the engagement closes.
Data handling
Client data is accessed only as required to perform the scoped work, is not used for any other purpose, and is deleted or returned at the end of the engagement on the timeline set out in the contract. Where an incident investigation requires preservation of evidence, the chain of custody is documented from the first artefact onward, so the material remains usable if it is ever needed in a legal matter.
Start with a scoping call
Thirty minutes is usually enough for us to tell you what the work should cover and what it should cost.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.