A certified hacker who works to a written standard
Certus is a senior practice. Every engagement is led by a certified hacker working to an agreed written scope, so a certified hacker never touches anything you have not approved. Moreover, the fee is fixed before any testing starts.
Methodologies and standards our work follows
The standard a certified hacker works to
A certified hacker gets depth from method, not from badges. Each standard below defines how a phase of the work is carried out. Therefore a certified hacker engagement is repeatable, and the report can be checked against a published framework.
| Standard | What it covers | How we apply it |
|---|---|---|
| PTES | The overall execution standard, from scoping through to reporting | It sets the phase order for every certified hacker engagement |
| OWASP | Web and API testing methodology, including business logic abuse | Applications are tested against the testing guide in full |
| Manual-led | Chained exploitation that automated tooling cannot model | Tools inform the work, but findings are proven by hand |
| Rules of engagement | Permitted techniques, testing windows and escalation contacts | Agreed in writing and signed before the window opens |
| Evidence handling | How findings are stored, transferred and destroyed | Encrypted throughout, then destroyed once the project closes |
Why a certified hacker leads with method
A named method proves the work can be repeated and argued with. In contrast, a tool report proves only that a tool ran. That is why every phase below maps to a published framework, and why the report shows the route rather than a list.
How a certified hacker engagement runs
Every certified hacker engagement follows the same five stages, and the fee is fixed before the first of them begins. Because the order never changes, you always know what is happening and what comes next.
Written scopeYou describe the estate and the threat, and we return a scope in writing. It names what is in, what is out, and what the engagement is meant to prove.
Authorisation and rulesThe system owner signs the scope, the testing windows and the escalation path. Nothing starts until that document exists.
Manual-led testingTooling maps the surface, then a certified hacker does the work by hand. Since attackers combine weaknesses, we chain findings rather than list them.
Report and written debriefYou receive reproducible chains, business risk context and prioritised fixes, with a written walkthrough from the certified hacker who ran the test.
Retest and closureOnce your team has applied the fixes we test them again, so closure is evidenced. Evidence is then destroyed and nothing is retained.
Where a certified hacker earns the fee
Every engagement is scoped to your threat model, because a generic playbook finds generic problems. In short, these are the mandates our certified hackers lead most often.
Applications, authentication, and the interfaces behind them, tested against your real business logic.
Internal and external infrastructure, including the segmentation an intruder pivots through.
Configuration, roles, and trust relationships, that is, the places where quiet privilege accumulates.
An objective-driven simulation of a determined attacker, because people and process fail alongside technology.
Personal footprint, home network, and device hardening for founders, executives and their families.
A complimentary retest once you have applied the fixes, so the closure is evidenced rather than assumed.
Institutional first, private clients by exception
Our institutional practice is the primary focus. Our certified hackers act for security teams inside large organisations, on retainer and on named engagements.
For private individuals we accept a small number of bespoke mandates each year. Those are reserved for technically complex threats, and our most senior certified hackers lead them directly. In short, it is the same standard of attention, opened to a handful of people who genuinely need it.
We do not actively market that side of the practice. Since capacity is the constraint, we also reserve the right to decline work that falls outside our technical rigour.
“We do not publish client names. References come in writing under NDA.”
A logo strip proves nothing, because logos can be copied from anywhere. Instead we offer a redacted report, a named certified hacker, and a written reference once the NDA is signed.
Every project is a fixed fee, agreed after we understand the threat model. Therefore the invoice never grows because a test took longer than expected.
Proof a certified hacker should be judged on
Anyone can claim competence, so we would rather show a fragment of the work. Below is a redacted finding from an authorised engagement, presented the way it reaches the client.
- Client
- Retail group, North America
- Entry point
- Exposed continuous integration runner token
- Chain
- Runner token to service account to vault path to domain administrator
- Time to impact
- 41 hours from kickoff
- Business impact
- Full control of the production identity plane
- Remediation
- Three configuration changes, zero downtime, verified on retest
A retail group, domain administrator in 41 hours
No scanner would have flagged that path, because each step looked harmless alone. Our certified hacker chained them, proved the impact, and handed over three fixes. The client closed all three without downtime.
Fixed fees, scoped in writing
Where a full certified hacker engagement usually settles. The floor for a full engagement is $25,000, while red team work begins higher.
We quote a fixed fee after a written scoping brief, so there is no hourly billing and no change orders. Moreover, the full programme is not the only door, because the bounded assessment below is a different engagement rather than a reduced one.
A bounded certified hacker assessment
from $4,500 Second doorThe Security Posture Assessment is a bounded review of what you expose to the internet. We map your public estate, test it, and verify every finding by hand rather than sending you a scanner export. Scope is fixed at up to five external hosts and one public web application. Your report then arrives within five business days.
Suited to
- An enterprise customer, an insurer or an investor has asked for evidence of testing, and you have a date to meet.
- Nothing external has ever been tested, so you first need to know what is actually reachable.
- You would rather see how we work on something small before committing to a full programme.
Not this engagement
- Internal network, Active Directory or cloud role review.
- Business logic testing, or work that reads your source code.
- Full exploitation chains against a defended estate.
- Auditor-grade evidence for SOC 2 or PCI, which needs the full engagement above.
The fee is credited in full. Commission a full engagement within ninety days of your report and the whole review fee comes off the price. Consequently the review costs you nothing if you go on to the deeper work.
This is a different engagement, not a smaller version of the one above. Moreover, it is priced by scope rather than by depth of care. Consequently, where the review finds something that needs the deeper work, we say so plainly and quote it separately.
Commitments we put in writing
These are the assurances a buyer of sensitive work needs. Moreover, they belong on the page rather than buried in the terms.
- Authorisation firstWe test only systems you own or are explicitly authorised to test.
- Non-disclosure as standardSigned before any technical discussion, so nothing is shared first.
- No retention of findingsYour data and results are destroyed once the project closes.
- No subcontractingThe named practitioner does the work, because handoffs lose context.
- Insured and clearedErrors and omissions cover, plus background-checked practitioners.
- Encrypted throughoutEvidence and reports move over encrypted channels only.
Questions about hiring a certified hacker
Is hiring a certified hacker legal?
Yes, provided the work is authorised. A certified hacker only tests systems the client owns or has written permission to test. Because authorisation is the dividing line, we require it in writing before any engagement starts.
What does a certified hacker actually do?
The work is authorised attack simulation. We attempt to reach something valuable using the methods a real intruder would use, then hand back the route, the evidence and the fix. Written permission from the system owner is what separates it from an offence.
How is this different from a vulnerability scan?
A scan lists issues one at a time, while an engagement links them into a route and proves the impact. Because attackers combine small weaknesses, the chain is usually far more serious than any single item in it. Every finding is also validated by hand, so the report carries no noise.
Will you work with private individuals?
Our primary practice is institutional. However, we accept a small number of private mandates each year for founders, executives and families with a genuine threat model. A senior certified hacker leads that work directly.
What does a certified hacker engagement cost?
A full certified hacker engagement is fixed-fee from $25,000, and most settle between $35,000 and $120,000. Alternatively, the bounded Security Posture Assessment starts at $4,500 and covers up to five external hosts and one web application. We quote one fixed fee after a written scoping brief either way, so there is no hourly billing. Moreover, the assessment fee is credited in full against a full engagement commissioned within ninety days.
What does a certified hacker deliver?
You receive a report with reproducible attack chains, business risk context, and prioritised remediation. Moreover, the certified hacker who ran the test writes your debrief directly. A complimentary retest then confirms your fixes.
Standards library
How a certified hacker engagement follows published standards
Each note explains one standard or engagement type, and what it means for your written scope.
- Penetration testing standards
- OWASP penetration testing
- Penetration testing contract
- NIST 800-53 penetration testing
- Vulnerability assessment and penetration testing
- Purple team penetration testing
- FFIEC penetration testing
- GLBA penetration testing
- NIST CSF penetration testing
- ASVS penetration test
- Non intrusive penetration testing