Our Approach
Methodology is the difference between testing and theatre.
Anyone can run a scanner. Rigorous security work means knowing what to look for, proving what you find, and leaving the client stronger than you found them. This is how we do it.
Six disciplines
What every Softous engagement has in common
Threat modelling before testing
We begin by understanding what an attacker would actually want from your organisation — data, access, disruption — and model the paths they would take. Testing effort goes where real risk lives, not where checklists point.
Scoped, written authorisation
No testing begins without written authorisation defining systems, boundaries, techniques and timing. You know exactly what will happen, when, and who to call if anything looks wrong.
Evidence-validated findings
A finding is only a finding when we can prove it. Every reported issue carries reproduction steps, captured evidence and an assessed business impact — verified by a second pair of eyes before reporting.
Dual-audience reporting
Executives receive risk in business language. Engineers receive technical depth with reproduction steps and idiomatic fixes. One engagement, two honest views of the same truth.
Remediation and retest
We stay available while your team implements fixes, then retest to confirm findings are genuinely closed. A report that gathers dust helps no one.
Continuous improvement
Each engagement ends with root-cause themes and programme-level recommendations, so the next assessment starts from a stronger baseline than the last.
Frameworks we work within
Recognised frameworks, applied with judgement
Our testing and advisory work aligns with established industry frameworks. Frameworks guide our rigour — they never replace it.
- OWASP Testing Guide & ASVSApplication and API security testing
- MITRE ATT&CKAdversary behaviour and attack-path mapping
- PTES & NIST SP 800-115Penetration testing execution and structure
- CIS BenchmarksConfiguration and hardening baselines
- NIST Cybersecurity FrameworkGovernance, risk and programme maturity
- ISO/IEC 27001Information security management readiness
Framework references describe methodology alignment — not certifications, accreditations or affiliations.
See how this applies to a specific service
Each service page details its own methodology, scope and deliverables.
Start the conversation
Know where you stand. Secure what comes next.
Tell us what you're building, protecting or preparing for. Our specialists will help you identify the right security engagement for your needs.