02 / Execution
The five phases of an engagement
Every engagement runs through the same five phases. Each phase has a defined output and a specific failure it prevents.
01 / Scoping & Written Brief
Owner / The founder
A one-page scope — what’s examined, what’s excluded, the fixed fee and the delivery date — agreed in writing before any work starts.
Without it: Work starts on a verbal understanding of a ‘quick look’, and expectations quietly diverge by the second week.
02 / Read-Only Onboarding
Owner / The founder, alongside your team
NDA signed, read-only repository access, and short architecture interviews with your lead engineers.
Without it: The review runs on guesses instead of your actual system — and misses the failure modes only your team can describe.
03 / The Work, In Weekly Slices
Owner / The founder
Findings and working output in weekly slices — you see the real thing while it is still cheap to change.
Without it: You discover the gaps only at the final readout, when changing course costs the most.
04 / Verification Before It Ships
Owner / The founder
Every change is read before it ships, with review effort allocated by risk — roughly a third of the cycle on our own builds, and it grows with complexity.
Without it: Green builds and passing tests hide the failures that matter — the ones that appear only under real load or a real attacker.
05 / Report, Debrief & Handoff
Owner / The founder
A severity-ranked report (P0–P3), a 90-minute live debrief, and complete handover of code, infrastructure and documentation — you own all of it.
Without it: Findings die in a document, and the system drifts back to its old state within a quarter.