Methodology - How we test, written down.

Authorization first. Testing starts only after the system owner signs the rules of engagement: systems, accounts, dates, techniques and stop conditions.

Map before we attack. We model data flows, tenants, tools and trust boundaries, then plan test cases against them.

Tools for breadth, people for depth. Scanners and open source AI test suites cover the standard list. Human time goes to chains, business logic and authorization.

Repeat what is not deterministic. AI behaviour changes between runs. Every AI finding is replayed and reported as a rate, for example 4 of 20 attempts.

Reproduce before reporting. Nothing reaches the report without evidence and exact reproduction steps.

Independent retest. The person who wrote a fix never retests it. The retest is documented with before and after evidence.