cyberagent.id · docs Methodology

Methodology & Standards

How we work, the tooling we use, and the quality controls that keep every report free of findings that cannot be proven.

ID/EN

Workflow

Surface mapping

Identify every asset, endpoint, user role, and data flow within scope. This includes undocumented paths discovered from client applications and configuration.

Manual review

Manual reading of code and configuration along critical paths: authentication, authorization, input processing, secrets handling, and system-to-system integration.

Dynamic testing

Testing against running systems with request-flow tracing, cross-role response comparison, and boundary input testing — entirely non-destructive.

Evidence validation

Every candidate finding is reproduced from a clean state, fully recorded (request, response, timestamp), and assessed for impact. Anything that fails this stage does not enter the report.

Reporting & re-test

Findings are documented with measured severity and remediation steps, then re-tested after fixes are applied.

Reference Frameworks

Framework	Role in our work
OWASP Top 10	Baseline for web application testing
OWASP API Security Top 10	Baseline for API testing
OWASP LLM Top 10	Baseline for testing language-model-based systems
OWASP ASVS & WSTG	Verification levels and detailed testing steps
MITRE ATT&CK	Mapping attacker techniques for detection relevance
NIST CSF 2.0	Framework for positioning risk at the organizational level
ISO/IEC 27001	Mapping findings to information security controls
PTES	Framework for end-to-end testing phases
CVSS	Comparable severity scoring

Quality Control

✓ Every finding is verified twice: when it is discovered and when the report is written.
✓ Impact claims must be demonstrable, not estimated. Where impact depends on specific conditions, those conditions are stated explicitly.
✓ Severity is calculated, not felt. Without full exploitation evidence, the severity rating is lowered.
✓ Duplicate findings and cosmetic issues with no impact are merged or dropped.
✓ The report states what was not tested, so there is no impression of broader coverage than actually delivered.

Ethics of Engagement

Rule	Application
Authorization	Written, from the system owner, before work begins
Non-destructive	No modification, deletion, or corruption of data or configuration
Data	Not exfiltrated, not used outside the engagement, deleted after reporting
Third parties	Not tested without separate authorization
Transparency	Testing activity can be explained and traced from logs on request