Your customer asked for a pentest and SOC 2 evidence.

What usually starts the conversation

Enterprise security questionnaires; SOC 2 or ISO 27001 audits; a deal blocked by a security review; PCI DSS 4.0.1 for e-commerce. Auditors and compliance platforms expect an independent test and vulnerability-management evidence.

The objections we hear, answered

"We need a CREST firm" — auditors and questionnaires almost never require it; we route red-team work to an accredited partner. "What if you are unavailable?" — documented handover, capped concurrent engagements, a named backup practitioner.

The proof we bring

Ungated sample pack; published methodology and turnaround; attestation letter; evidence delivered into Vanta/Drata; the human-and-AI statement of practice.

How an engagement runs

1. Discovery and conflict screen. Twenty minutes to confirm scope, authorization and that nothing puts us in conflict.
2. Written authorization. Engagement letter and rules of engagement signed by both sides before any testing.
3. Find, fix, retest. Named practitioner, agent-assisted, on a dated plan with a report due date and a retest date.
4. Attestation. The letter is issued only after the retest record exists. Evidence hashes included.