// Methodology.jsx — VAPT-specific 6-phase process timeline const PHASES = [ { n: '01', t: 'Scope & Threat Model', d: 'We agree on your assets, your likely adversaries, and what a successful test looks like before testing begins.', detail: 'A signed statement of work listing in-scope and out-of-scope assets, rules of engagement, emergency contacts, and the threat model we are testing against.', rows: [ { k: 'Deliverable', v: 'Statement of work · rules of engagement · threat model' }, { k: 'Lead', v: 'Engagement lead (OSCP or higher, 8+ years)' }, { k: 'Duration', v: '2–3 business days' }, ], }, { n: '02', t: 'Reconnaissance', d: 'We find what an attacker would find first: your public footprint, leaked credentials, and forgotten infrastructure.', detail: 'Exposed services, third-party dependencies, leaked credentials, and shadow IT, collected into one inventory your engineers can act on right away.', rows: [ { k: 'Tooling', v: 'Custom enumeration, Amass, Shodan, Censys' }, { k: 'Output', v: 'Asset ledger · pre-engagement findings' }, { k: 'Duration', v: '2–4 business days' }, ], }, { n: '03', t: 'Exploitation', d: 'Manual testing led by an experienced tester. We find issues, prove them, and combine them into realistic attack paths.', detail: 'Every finding is reproducible, with step-by-step replay, evidence, payloads, and an impact rating that reflects your business.', rows: [ { k: 'Approach', v: 'Manual chained exploitation, OWASP and PTES aligned' }, { k: 'Output', v: 'Proof of concept · payloads · screen captures per finding' }, { k: 'Duration', v: '5–15 business days, depending on scope' }, ], }, { n: '04', t: 'Reporting', d: 'An executive summary for leadership and a technical report for your engineers.', detail: 'CVSS, CWE, OWASP, and MITRE ATT&CK mappings, severity calibrated to your environment, and remediation guidance checked against your stack.', rows: [ { k: 'Deliverables', v: 'Executive report · technical report · raw evidence pack' }, { k: 'Mappings', v: 'CVSS v3.1 · CWE · MITRE ATT&CK · compliance' }, { k: 'Duration', v: '3–5 business days' }, ], }, { n: '05', t: 'Remediation Support', d: 'We work alongside your engineers until the fixes are in.', detail: 'A shared Slack or Teams channel runs from kickoff through retest. We answer questions throughout remediation and debrief with your security team at the end.', rows: [ { k: 'Channel', v: 'Slack, Teams, or Zoom — your choice' }, { k: 'SLA', v: 'Critical findings disclosed within one hour' }, { k: 'Duration', v: 'Up to 90 days included' }, ], }, { n: '06', t: 'Retest & Sign-off', d: 'Free retesting within 90 days. Every finding is marked as fixed or still open.', detail: 'A retest report shows what was fixed, what was partially fixed, and what you have accepted as risk. It is signed off by your tester and ready for your auditor.', rows: [ { k: 'Deliverable', v: 'Retest delta report · sign-off letter' }, { k: 'Cost', v: 'Included — no separate engagement' }, { k: 'Duration', v: '2–4 business days' }, ], }, ]; const Methodology = () => { const [active, setActive] = React.useState(0); return (

Methodology

Our methodology

Six phases, documented at every step and aligned to OWASP WSTG, OSSTMM, NIST SP 800-115, and PTES.

{/* Timeline */}
{PHASES.map((p, i) => ( ))}
{/* Detail panel */}
PHASE {PHASES[active].n}

{PHASES[active].t}

{PHASES[active].detail}

{PHASES[active].rows.map(row => (
{row.k} {row.v}
))}
); }; Object.assign(window, { Methodology });