Approach
How we work
Every engagement follows the same five steps, so you know what you're buying, who is doing the work and what you'll have at the end.
At a glance
CyberAccord runs every engagement in five steps: a free scoping call, a fixed written quote, a senior-led assessment, hands-on delivery to close gaps, and a plain-English readout with evidence organized for auditors and customers. Certified practitioners do the work themselves, and findings are ranked by business risk rather than scanner severity.
The engagement
Five steps, from first call to evidence handover
- 01
Scoping call
A free 20-minute call to understand what's driving the need: an audit, a customer questionnaire, an insurance renewal or an incident.
- 02
Fixed quote
A written scope with defined deliverables and a fixed price. No open-ended meter.
- 03
Assessment
Senior practitioners test, review and interview against the framework or threat model in scope.
- 04
Delivery
We close gaps with you: hardening, policies, controls and managed protection where it fits.
- 05
Readout and evidence
A plain-English readout, findings ranked by business risk, and evidence organized for auditors and customers.
Principles
What stays the same on every engagement
Senior hands on the work
The practitioners who scope your engagement are the ones who test, configure and prepare evidence. Nothing is handed down to juniors.
Protection that produces proof
Managed security, testing and compliance come from one team, so the controls and the evidence that proves them come from the same place.
Framework-fluent
Deliverables map to the frameworks your auditors and customers use: SOC 2, ISO 27001, HIPAA, PCI DSS, NIST and others.
Fixed scope, plain English
Fixed quotes, defined deliverables, and findings explained in terms of business risk, with clear owners for each fix.
Scope and price
How scoping and fixed quotes work
Scope comes from the scoping call: what's driving the need, which systems and frameworks are involved, and any deadline set by an auditor, customer or insurer.
We then send a written scope that lists what's in, what's out, the deliverables you'll receive and a fixed price. Work starts once you've agreed it.
If something changes partway through, such as a new system coming into scope, we agree the change in writing before doing the extra work.
Findings
How we rank findings
A scanner's severity score describes a flaw in general. We rank each finding by what it means for your business.
Business risk first
We weigh technical severity, using CVSS where it applies, against what is actually exposed in your environment: the data, systems and obligations affected.
An owner for every fix
Each finding says who should fix it: your team, your IT provider or us. Nothing falls between teams.
Plain English
Each finding explains what we found, why it matters and what to do next, with the technical detail kept for the people making the fix.
Methods
Standards we follow
Our testing and reporting follow published methods, applied according to what's in scope.
- OWASP WSTG
- OWASP MASTG
- OWASP Top 10 for LLM Applications
- PTES
- NIST SP 800-115
- CVSS
- CWE
- NIST AI RMF
- MITRE ATLAS
FAQ
Questions about how we work
Why a fixed quote instead of hourly billing?
A fixed quote makes scope explicit before work starts, so you know exactly what you'll receive and what it costs. If scope genuinely changes, we agree the change in writing first.
Who actually does the work?
Senior certified practitioners. The people you meet on the scoping call are the people doing the testing, configuration and evidence preparation.
What do we get at the end?
A readout session, a written report with findings ranked by business risk and clear owners, and evidence organized the way auditors and customer security reviewers expect to see it.
Can you work with our existing IT provider?
Yes. Many engagements run alongside an in-house team or managed IT provider. We define who owns each fix up front so nothing falls between teams.
Talk to a security practitioner
Book a free 20-minute consultation. We'll learn what's driving the need and recommend a scoped next step with a fixed quote.