How engagements work

One named consultant, not a bench. Abin Antony performs the testing, writes the report and runs the remediation call. Nothing is subcontracted, and you always know who did the work.

Scoping usually happens within two working days of first contact, and testing typically starts within one to three weeks depending on the queue. Urgent pre-launch work can sometimes be accommodated sooner — ask.

A signed authorisation letter, test accounts for every user role, environment details, and a technical contact reachable during the test window. For mobile work, a signed build. For cloud work, a read-only role you create and revoke.

Yes, before any technical detail is exchanged. Your NDA is preferred; a standard mutual one is available if you would rather not draft it.

Fixed price per engagement, agreed after scoping, with the number of testing days stated in the proposal. No hourly billing surprises, and the retest is included rather than quoted separately.

Yes — every finding is retested once, within 30 days of the report, at no additional cost. The reissued report showing closed findings is the version you hand to customers and auditors.

Findings can be mapped to SOC 2, ISO 27001, PCI DSS or an enterprise customer's questionnaire. Say which one at scoping and the mapping ships with the report. Certification itself requires an accredited auditor — this is the engineering half.

Where necessary, under written rules of engagement: no denial-of-service testing, no bulk data extraction, agreed request rates and a monitored contact channel. Staging that mirrors production is always preferred.

You hear about it the same day, through the channel agreed at kickoff, with enough detail to start mitigating immediately. Critical findings are never held back for the report.

Yes. Remote engagements run across the Gulf, Europe, Singapore and Australia. Indian Standard Time overlaps comfortably with Gulf, European and South-East Asian working hours.

Evidence is minimised, stored encrypted, and destroyed 90 days after the engagement closes unless you ask otherwise. No production data is exported beyond the minimum needed to prove a finding.

Say so, with reasoning. Severity ratings are a judgement call about your business context, and context you hold can change them. Disputed findings stay in the report with both positions documented — that is more honest than quiet deletion.