Free Exposure Brief
Request a Free Exposure Brief
Non-invasive public-surface orientation. Short memo. No obligation.
The Free Exposure Brief uses non-invasive public information and observation. Submitting this form does not authorize active security testing. Active assessments require separate written authorization and agreed Rules of Engagement.
Authorized web application security assessments
Start with a free non-invasive Exposure Brief — then a paid assessment under written authorization when you need validated findings.
Outside-in is the primary package. User-level and Inside-assisted are scoped upgrades.
Unauthenticated review of your public production surface — validated findings under written authorization.
Upgrade with normal test accounts to see what authenticated users can reach.
Deeper collaborative work with architecture context, technical leads, or limited internal access.
The Brief orients. Outside-in validates.
Accepted Brief requests are normally delivered within 1–2 business days after verification. Non-invasive orientation only.
Request Free BriefOnly after qualification and written authorization (ROE).
See Outside-in packageA Brief request starts verification — not testing. Active assessment starts only after scope and written authorization.
No. The Free Exposure Brief uses non-invasive public observation only. Submitting the form confirms you own, operate, or are authorized to represent the submitted domains for that Brief — it does not authorize active security testing. Active assessment starts only after qualification and separate written authorization with Rules of Engagement. We do not run destructive tests.
The Brief orients and recommends depth — it does not validate findings. Outside-in delivers validated findings, evidence, severity, remediation guidance, a remediation discussion, and one bounded retest under written rules of engagement.
Accepted Free Exposure Brief requests are normally delivered within 1–2 business days after verification. A paid Outside-in assessment is typically 3–5 working days of assessment work after scoping, readiness, and written authorization — timing is confirmed on the scoping call.
For the Free Brief: primary domain, work email, and confirmation that you own, operate, or are authorized to represent the submitted domains. For paid Outside-in: written rules of engagement and agreed domains. Upgrades may add test accounts or internal collaboration when scoped.
Yes. Client data and evidence stay inside the engagement. We minimize what we collect, protect artifacts during the work, and tear down engagement environments when it ends. We do not publish client findings.
Act on the memo, book a scope call to discuss Outside-in (or an upgrade), or stop — no obligation to continue.
Start with a free non-invasive Brief — or book a scope call about paid assessment.
