Access
Accounts for each role and tenant, authorization-model documentation, and an integration inventory.
INDUSTRY—PATTERNS
One delivery standard. A different threat boundary for every industry.
This page makes no unverified claim about client experience. It shows how scope, access, constraints, and evidence change with the system, risk, and applicable requirements.
01
Multi-tenant SaaS and platforms
The boundary crosses identities, tenants, roles, web and API surfaces, support workflows, payments, and integrations.
Evidence
Negative authorization matrix, abuse paths, and tenant-isolation evidence.
02
Fintech and payments
Map the cardholder-data environment, identities, ledgers, third-party services, fraud controls, and segmentation. A PCI-related claim is made only after applicability and scope are confirmed.
03
Healthcare and sensitive data
Minimize test-data exposure, use synthetic records, define an incident path, and constrain evidence, retention, and transfer under contract and applicable law.
04
Cloud, infrastructure, and supply chain
Test IAM paths, secrets, accounts and projects, Kubernetes, CI/CD, SaaS, and suppliers while respecting platform restrictions and obtaining explicit authority from relevant third parties.
05
Industrial, automotive, and physical systems
Safety and operational continuity precede test depth. Work needs a dedicated lab or window, stop conditions, safety personnel, equipment, and explicit authority for every component and supplier.
06
Procurement, audit, and customer assurance
Delivery distinguishes applicable requirements, control evidence, and test methods. The coverage and exclusions matrix lets an assessor see what happened without presenting a penetration test as compliance certification.
NEXT DECISION
Start with the real system, not the industry label.
The initial interview translates assets, roles, data, requirements, and constraints into a scope draft for human review.
Build a scope draft