Five stages of how we work
Step 1: Understand
A short conversation about your business, your environment, what has prompted the request and any customer, audit or regulatory deadline behind it.
A shared understanding of the goal
Step 2: Assess
We test, review or discover, depending on the service, within a written scope and signed authorisation. Critical issues are reported straight away.
An evidence-based view of risk
Step 3: Plan
Findings become a prioritised plan: specific fixes, the right controls or the right platform, with owners and realistic timing.
Prioritised, practical actions
Step 4: Implement
You fix with our guidance, or we help put controls in place, such as deploying and configuring endpoint protection or hardening identity.
Controls in place and verified
Step 5: Operate and improve
Retesting confirms fixes. Where agreed, managed detection, health checks or advisory support continue, so security keeps improving.
Retest, review or ongoing support
Rules of engagement, agreed before testing
- Scope
- The exact systems, applications, IP ranges and accounts in scope, and what is explicitly out of scope.
- Testing windows
- When testing may take place, including any blackout periods for business-critical events.
- Permitted techniques
- What is allowed and what is not. Denial-of-service and social engineering are excluded unless you specifically ask for them.
- Source addresses
- The IP addresses we test from, so your team and your providers can recognise our traffic.
- Contacts and escalation
- Named contacts on both sides, and how to reach each other urgently during testing.
- Stop conditions
- When we pause and call you, such as signs of instability, evidence of an existing compromise, or access to unexpectedly sensitive data.
During testing
You have a named contact at Cenvox throughout. We keep you updated at the frequency agreed in the rules of engagement, and we never go quiet until the report arrives.
If we confirm a critical issue, such as one that exposes sensitive data or gives direct administrative access, we tell you as soon as it is verified rather than waiting for the report, so you can act straight away.
If a system shows signs of instability, we stop the relevant testing and contact you before continuing.
Severity ratings and reporting
Findings are rated with the Common Vulnerability Scoring System (CVSS) and reviewed against your business context. Each finding carries evidence, affected assets, business impact and specific remediation guidance.
Reports include an executive summary for leadership and a scope and methodology statement for auditors and customers. A debrief call is part of every testing engagement.
Where retesting is in scope, we verify your fixes and issue an updated report, so you can show that issues were resolved, not just found. Our guide to preparing for a penetration test explains how to get the most from the report.
How we handle your data
- We only ask for the access a test actually needs.
- Evidence is limited to what is necessary to demonstrate a finding. We avoid copying real personal or business data wherever possible.
- Where evidence is stored, who can access it and when it is deleted are agreed with you in writing.
- Findings are shared only with the contacts you nominate.
- Test accounts and credentials you provide should be disabled or rotated when testing ends, and we will remind you to do so.
- Your data and findings are used only for your engagement.
Methodologies by service
| Service | Standards and references |
|---|---|
| Penetration testing (VAPT) | PTES, NIST SP 800-115, MITRE ATT&CK, CIS Benchmarks |
| Web application and API security testing | OWASP WSTG, OWASP ASVS, OWASP Top 10, OWASP API Security Top 10 (2023) |
| Mobile application security testing | OWASP MASVS, OWASP MASTG, OWASP Mobile Top 10 (2024) |
| Cloud security assessment | CIS Foundations Benchmarks, provider security best practice |
| Secure code review | OWASP ASVS, OWASP Code Review Guide, CWE Top 25 |
| Managed detection and response (MDR) and endpoint security | Vendor-recommended endpoint configuration (including Sophos), MITRE ATT&CK |
| Incident response and DFIR support | NIST SP 800-61, ISO/IEC 27035, CERT-In Directions (2022), MITRE ATT&CK |
| Embedded and IoT security testing | OWASP IoT Top 10, OWASP FSTM, ETSI EN 303 645, NIST IR 8259 |
| AI security services | NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLM Applications, MITRE ATLAS |
| AI and LLM penetration testing | OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF |
| Identity and access management (IAM) security | NIST SP 800-63, CIS Controls, Microsoft security baselines, MITRE ATT&CK |
| Kubernetes and container security | CIS Kubernetes Benchmark, NSA/CISA Kubernetes Hardening Guidance, OWASP Kubernetes Top 10 |
| Security advisory and risk assessment | NIST CSF 2.0, ISO/IEC 27001 and 27002, CIS Controls |
| Compliance readiness support | Testing evidence for ISO/IEC 27001, SOC 2, PCI DSS and Indian regulatory VAPT requirements |
What we will not do
- Claim that any test or service makes you “100% secure”. No honest provider can.
- Certify you as compliant. Testing and readiness work support compliance; accredited bodies certify it.
- Test anything without your written authorisation, or outside the agreed scope.
- Present unverified scanner output as penetration test findings.
- Promise monitoring coverage or response actions beyond the service scope agreed in writing.
More about Cenvox and what drives our approach Security risks by industry
Ready to scope an engagement?
Tell us what you need to protect and what has prompted it. We reply to arrange a short scoping call, with no obligation.