How we test
We started HackMoat because attackers got AI before defenders did. We use the same class of models, under contract and inside a signed scope, so you see what they would see, first.
The engagement, phase by phase
We follow the structure of PTES, the Penetration Testing Execution Standard, a public description of how a test should run.
- 1
Pre-engagement
Scope, testing window, contacts and rules of engagement, recorded in the signed authorization.
- 2
Reconnaissance
We map what is reachable: domains, hosts, services and applications in scope.
- 3
Vulnerability analysis
We look for weaknesses, combining automated scanning with manual review.
- 4
Exploitation
We confirm each weakness by using it, within the limits of the authorization, to show its real impact.
- 5
Reporting and retest
We document every finding with evidence and a fix, then verify your fixes.
Standards we work to
- OWASP
- The Open Worldwide Application Security Project. We use its Web Security Testing Guide for application tests and its Top 10 to explain common risks.
- PTES
- The Penetration Testing Execution Standard. It structures each engagement from pre-engagement to reporting.
- CVSS
- The Common Vulnerability Scoring System. Every finding gets a CVSS score so severity is comparable across reports and vendors.
Our principles
- 01
Authorization first
No test starts without a signed authorization. We do not touch anything outside it.
- 02
Fixed scope, fixed price
You know what is tested and what it costs before we begin. No hourly billing, no surprises.
- 03
Do no harm
We avoid destructive techniques and denial of service. When a system becomes unstable, we stop.
- 04
Evidence over opinion
Every finding comes with proof that your team can reproduce. No unverified scanner output.
- 05
Tell you early
Critical findings are reported the same day, not weeks later in the final report.
- 06
Confidential by default
Findings stay between you and us. Reports are only available in your private client portal.
Permission first. Then proof.