Start a brief Brief

Menu

Start a brief

Methodology

How it runs

The same five stages on every engagement, whichever service line it starts from. Use this page to judge the process before you commit to a piece of work.

The five stages

05

The five stages of a Rynexor engagement A left-to-right sequence: Scope (in writing), then Evidence (before opinion), then Work (that lands), then Verify (re-test the fix), then Handover (not dependency). 01 Scope in writing 02 Evidence before opinion 03 Work that lands 04 Verify re-test the fix 05 Handover not dependency

  1. Stage 01

    Scope, in writing

    What is in, what is explicitly out, who is in the loop, and what happens if we find something serious on day two. Signed before work starts.

    • A written scope and rules of engagement
    • A named contact on both sides
    • An agreed escalation path

  2. Stage 02

    Evidence before opinion

    Findings include reproduction steps. Recommendations include the measurement behind them. Inferences are labelled as such in the same sentence as the claim.

    • Reproducible findings, not severity labels alone
    • Raw data you can re-run
    • An explicit list of what we could not verify

  3. Stage 03

    Work that lands

    Prioritised by what is exploitable or actionable in your environment, not by a generic score. We work with the people who must implement the fixes. A report nobody acts on is an expensive PDF.

    • Prioritised plan mapped to your stack
    • Working sessions with your team
    • Fixes checked against the original finding

  4. Stage 04

    Verification

    We re-test. A closed ticket and a closed vulnerability are different things, and the gap between them is where most incidents live.

    • Re-test of every accepted fix
    • A revised report reflecting the current state

  5. Stage 05

    Handover, not dependency

    You keep the tooling, dashboards, runbooks, and reasoning. A retainer should continue because it earns its place, not because leaving would break the work.

    • Documentation written for your team
    • Access and ownership transferred
    • A debrief where you can challenge the conclusions

What we will not do

  • Rename a vulnerability scan as a penetration test.
  • Report a platform's own conversion figure as if it were revenue.
  • Buy links, followers, or reviews. All three are detectable, and all three cost more later than they return now.
  • Hold your accounts, data, or documentation hostage to a renewal.
  • Take an engagement we do not think will pay for itself. We will say so, and explain what would.

Put it to the test.

Describe the problem. We will tell you which stage you are at, and whether we are the right people to run it.

Start a brief