1. Scope and authorisation
- Business outcomes and critical services
- Exact assets and exclusions
- Test window, safety limits, contacts, and kill switch
- Versioned Rules of Engagement and approval
BalticSec methodology
A controlled process for finding what matters and proving what changed.
Tools support the work; they do not define it. Every engagement combines written authorisation, expert judgement, evidence QA, and a verifiable remediation loop.
Process
Four accountable phases
2. Threat-informed testing
- Manual expert testing appropriate to the technology
- OWASP and relevant industry methodology
- Hypotheses linked to credible attacker objectives
- Bounded automation only where explicitly authorised
3. Validation and QA
- Reproducible evidence and affected occurrence
- Exploitability, attack path, and business impact
- Severity and remediation guidance review
- Operator approval before client publication
4. Remediation and proof
- Owner, decision, due date, and risk acceptance
- Secure evidence exchange and clarification
- Retest against the original reproduction
- Executive and technical report snapshots
Automation policy
Controlled automation, never unreviewed publication
The pilot supports approved external web/API validation with a pinned tool profile and strict duration, rate, redirect, and scope boundaries.
An engine can report progress and create draft findings for its own run. It cannot publish, alter scope, write arbitrary tenant data, or access PostgreSQL. Callback permissions are short-lived and bound to one tenant, engagement, and scan run.
Start with evidence
Turn the next security test into a continuous assurance programme.
Explore a read-only product tour, or tell us what you need to prove and we will scope it with you.