Skip to content
    BlueBasket Labs

    Methodology

    How we test, report and get you ready.

    A transparent process based on recognised standards, so you, your customers and your auditors know what was done.

    Process

    Engagement lifecycle

    1. 1

      Scope

      Agree targets, environments, rules of engagement and what your customers or auditors need.

    2. 2

      Test

      AI-assisted testing with Shannon, validated and extended by a human tester.

    3. 3

      Fix

      Prioritised findings with reproduction steps and fix guidance; our engineers can help.

    4. 4

      Retest

      We verify fixes and issue an updated report you can share.

    5. 5

      Audit-ready

      Policies, evidence and controls mapped to your framework, ready for your auditor.

    Standards we follow

    • OWASP Web Security Testing Guide and Top 10
    • OWASP API Security Top 10
    • OWASP ASVS for verification depth
    • PTES (Penetration Testing Execution Standard) phases
    • CVSS for severity scoring
    • Framework mapping to SOC 2, ISO 27001 Annex A, Essential Eight and DPDP

    AI-assisted, human-verified

    Shannon performs autonomous reconnaissance and exploitation attempts within the agreed scope. A human tester reviews every result, reproduces findings, removes false positives and performs manual testing of business logic, authorisation and chained attacks.

    What the report contains

    Executive summary

    Overall risk, key themes and what it means for the business.

    Findings

    Severity, affected assets, evidence, reproduction steps and fix guidance.

    Retest status

    Each finding marked fixed, partially fixed or open after retest.

    Not sure where to start?

    Get in touch for a short call. We'll look at what your customers are asking for and recommend the smallest useful next step.

    Get in touchGet a free external scan