We design tests to be safe and predictable: agreed scope and written authorisation, change-window scheduling, rate-limits, and “do-not-touch” actions. Potentially disruptive checks run in staging where possible; production tests use non-destructive techniques and are monitored via CloudWatch/Azure Monitor/GCP logs. You get a live comms channel with pause/stop authority. In practice, downtime is rare, and if anything looks risky, we halt immediately.

• Deliverables: an executive summary for leadership, plus a technical report with severity, business impact, affected assets, evidence, reproducible steps, and clear remediation guidance—mapped to ISO 27001 and the Essential Eight. We run a readout workshop and offer retesting to verify fixes with an updated “resolved/mitigated” report.

• Timeframe: typical single-app or small cloud-footprint tests take 5–10 business days end-to-end (scoping → testing → reporting), depending on scope and access.

• Data handling: NDA-backed, least-data approach; evidence stored encrypted with strict access controls; retention only for the agreed period then securely destroyed. Australian data residency is available on request.

• Pricing: fixed-scope, fixed-fee proposals once we understand assets, complexity, and objectives—no surprises.