Skip to content
Gadfly CyberBook a scoping call

Four steps,one written scope.

An engagement is short and bounded. Each step produces something you can read and keep: a signed scope, an audit log, a findings report, a retest result.

  1. Scope, in writing

    We agree the targets, the testing window, the accounts we may use and what is off limits, and both sides sign.

    • Hosts and domains are allowlisted at the network layer, not only in a prompt
    • Anything not listed is out of scope and unreachable from the harness
    • Named contacts on both sides, with a stop procedure
    • No signed authorisation, no testing
    Egress rules3 hosts
    app.example.com:443Allow
    api.example.com:443Allow
    staging.example.com:443Allow
    *Drop

  2. Agents, constrained

    AI agents explore the application the way a tester would: mapping it, forming hypotheses and checking them. The harness decides what they are able to do.

    • Non-destructive by default; destructive checks need your written opt-in
    • Rate limits agreed with you so production stays healthy
    • Every request recorded in an audit log you can ask for
    • The model runs inside your environment, not a shared cloud
    Audit log1,284 entries · sample
    14:02:08GET app.example.com/login200
    14:02:09GET cdn.thirdparty.example.orgDropped
    14:02:11GET api.example.com/v2/…200
    14:02:11Rate limit reached, waiting—
    14:02:12GET api.example.com/v2/…403

  3. Findings, confirmed

    A suspected issue is not a finding. It becomes one when it can be reproduced and a human tester has confirmed it.

    • Request and response evidence for each confirmed finding
    • Human review on every critical before it reaches you
    • Only criticals surface by default; lower severities on request
    • Unconfirmed leads are kept out of the report
    GF-014 · Access controlCritical
    AgentProposed, with evidence
    ReviewerHuman tester
    Human reviewReproduced and confirmed
    Reported to clientAfter sign-off

  4. Fix, then retest

    You get clear notes on what to change. When you have fixed the issues, we retest them at no charge within the agreed window.

    • Remediation guidance written for the engineers who will fix it
    • Retest of every reported finding inside the retest window
    • An updated report showing what is closed and what is not
    Engagement GF-26-014
    StatusClosed
    Remediation notesDelivered
    Retest2 of 2 fixed
    ReportUpdated

What this is, plainly

An AI-accelerated pentest with human review on criticals. The agents widen coverage and shorten the calendar. They do not make the service fully autonomous, and they do not replace a penetration test carried out by people.

Start withthe scope.

A 30-minute call, a written scope, a fixed quote. Nothing is tested until rules of engagement are signed.

Book a scoping callRequest sample report