XEUS_CYBERASSISTMethodology
Testing only begins after written authorisation. Every phase produces artefacts you can hand to engineering, auditors or your board.
Engagement flow
Scroll to follow each phase. Deliverables are agreed up front so nothing arrives as a surprise at report time.
Before touching any system, we clearly agree in writing on what will be tested, when, and how, ensuring zero disruption to your daily operations.
We map out all your online websites, servers, and systems to see exactly what is visible to the public and where attackers might look first.
We test for vulnerabilities safely by hand—never using destructive tools—to verify if a weakness is real and can actually be exploited by bad actors.
We determine what a hacker could actually access if they got inside (e.g. customer data, private files) so you know exactly which fixes matter most.
You receive a clear executive summary anyone can understand, paired with specific, easy-to-follow technical fix instructions for your tech team or web developer.
Once you or your developers apply the fixes, we re-test the weaknesses for free to verify that your systems are sealed and secure.
CVSS v3.1 base score sets the starting severity; business context can raise or lower it, and we always show our reasoning.
| Severity | CVSS range | Notification | Remediation target |
|---|---|---|---|
| Critical | 9.0 – 10.0 | Immediate alert within 4 hours | Fix immediately |
| High | 7.0 – 8.9 | Notify within 24 hours | Fix within 30 days |
| Medium | 4.0 – 6.9 | Detailed in final report | Fix within 90 days |
| Low | 0.1 – 3.9 | Detailed in final report | Routine maintenance |
| Informational | 0.0 | Best practice tip | Optional enhancement |