Transparency

Methodology & Published Metrics

What our public figures include, how they are counted and what a reported finding contains.

Client findings, 2025–2026

The published client total is 14,650 unique findings. Records are deduplicated by finding ID or hash across the source exports. Laboratory and unattributed research records are excluded from the client figure.

The broader corpus contains 19,846 unique findings, including records outside this client subtotal. It is not presented as the client total. These figures are drawn from our internal record consolidation and are not an independent certification.

Engagements and targets

We publish a conservative figure of 25+ engagements for 2025–2026. The underlying records contain 47 project groupings and approximately 30+ distinct targets after related families are grouped. Targets and engagements are different units and are not interchangeable.

Evidence and acceptance

Our delivery standard is a reproducible proof of concept with every reported finding, together with impact, conditions and remediation guidance. This is distinct from client acceptance: we do not publish an acceptance percentage.

Scope and retesting

Every assessment starts with agreed assets, roles, environments and authorisation. Testing limitations are recorded. Retest coverage and timing are set out in the proposal; new assets and new features are scoped separately.

Metrics reviewed: 12 October 2026. Case studies are anonymised and should be read within their stated scope. Contact us about this methodology.