cyberagent.id · docs Engagement

Getting Started

Five steps from the first brief to the final report. No drawn-out procurement process: one email, one scoping call, one proposal.

Introductory program

Free security audit

One full engagement at no fee, delivered to the same standard and depth as a paid one. In return we ask for one thing: recognition — permission to reference this engagement in the cyberagent.id portfolio. You may remain anonymous.

ID/EN

Workflow

Send the brief

Describe what you are protecting (or the workflow you want built), the assets involved, and the outcome you expect. Send it to founder@cyberagent.id. We respond within 45 minutes during WIB business hours.

Scoping call

A complimentary 30-minute session to confirm the boundaries of the work, the asset list, scheduling preferences, and who will serve as your technical contact.

Proposal & agreement

We send a proposal covering scope, method, timeline, deliverables, and fees. A mutual NDA and a testing authorization letter are signed before work begins.

Execution

Testing or development runs within the agreed window, with regular updates. Critical findings are reported early — we do not wait until the end of the engagement.

Reporting & re-test

The final report is delivered together with evidence and remediation steps, followed by a debrief session. Once your fixes are in place, we re-test to confirm every finding is genuinely closed.

What to Prepare

✓ A list of in-scope assets (domains, APIs, IPs, repositories, or service accounts).
✓ A single technical contact who can make decisions and grant access.
✓ Written authorization from the system owner — mandatory, without exception.
✓ Test accounts with differing roles (where testing involves authentication or authorization).
✓ An agreed time window, especially where the system serves active users.

Important: we work only on assets with clear authorization. Where ownership of an asset cannot be demonstrated, that asset is excluded from scope.

Confidentiality & Data

Aspect	Terms
NDA	Available, and can be signed mutually before work begins
Data	Data accessed during the engagement is used solely for engagement purposes, is not copied outside the agreed environment, and is deleted once the report has been accepted
Publication	The name and details of the engagement are not published without written consent
Subcontractors	None. Work is performed by the CyberAgent.id core team

After the Engagement

We provide a debrief session for your engineering team, remediation Q&A support by email, and a scheduled re-test. For clients who require continuous coverage, a retainer model with periodic testing cycles is available.