predictable security spend. real results.

a pen test is a point-in-time assessment — typically 5–10 days of testing, once a year. mastermind runs continuously. your attack surface is monitored daily and the system re-tests it as it changes; you get the depth of a pen test with the coverage of continuous monitoring — plus proprietary ai-driven exploitation tooling and seasoned offensive researchers validating every finding.

all tooling runs locally on a hardened server — zero SaaS platforms processing or storing your data. your findings, scan results, and credentials never leave the environment. encrypted mesh network, SSH-only access. when you offboard, all engagement data is securely destroyed.

no. mastermind operates as a black-box red team by default — we test from the outside, exactly as a real attacker would. we only need the agreed scope (domains, IPs, applications) and signed rules of engagement. if you provide test credentials, we can go deeper — testing role-based access control, authorization boundaries, IDOR, and privilege escalation across your authenticated surfaces. if you want white-box coverage, we can review source code directly — identifying vulnerabilities that are invisible from the outside. API documentation and architecture context can also accelerate findings.

critical findings (P1/P2) are reported immediately via your preferred channel — typically within hours of validation. every finding includes a proof-of-concept demonstrating real impact, not theoretical risk. we don't report noise. if we report it, it's real and it matters.

from signed agreement to first scan: typically 48 hours. we configure your scope and begin reconnaissance immediately. you'll receive your first intelligence summary within the first week.

yes. all testing is conducted under a formal rules of engagement agreement that defines exact scope, permitted testing windows, and exclusions. we hold explicit written authorisation before any testing begins and comply with applicable computer misuse and data protection legislation in your jurisdiction — including the Computer Misuse Act 1990 (UK), CFAA (US), and equivalent laws across the EU and APAC. we carry professional indemnity insurance and can work within your existing compliance requirements.

yes. tier changes take effect at the start of the next billing quarter. upgrades can be arranged mid-quarter with pro-rated billing. all historical data and findings are preserved across tier changes.

if you consistently need more hours than your tier includes, upgrading is usually the best option. we'll advise based on your actual usage patterns.