Pentest remediation

Send us your findings

Three steps, no ceremony. The NDA comes first because it should.

1
Verify your email
We send a one-time sign-in link. It identifies you for the NDA and gives you a portal to collect documents later.
2
Sign the mutual NDA
Read it, fill in your details and sign on screen. Remedy Nine has already signed. You get the countersigned PDF instantly.
3
Upload your findings
Drag the pentest report and anything useful around it into the vault. We come back within two working days with a plan.

Step 1 — your email

A little more detail, if you need it

Sending your findings does not commit you to paid work. We agree scope and price before implementation.

01 What happens after I send my report?

After you send the report

01
Understand the findings
We review the report, ask about the affected systems and identify what needs further investigation.
02
Agree the work
Scope, price, access and timing are agreed before paid implementation begins. Sending a report does not commit you to a project.
03
Make the changes
We agree how changes will be tested and released, working with your team and its existing change process.
04
Verify and hand over
You receive a record of the changes, verification evidence and any remaining limitations or recommended next steps.

02 What does a finished fix look like?

What you receive

A useful handover shows what changed, how it was checked and what still needs attention.

Illustrative remediation recordFictional example · not client work

A sample of how a finding can be documented from diagnosis through verification.

01 / Finding: In this fictional portal, a signed-in user could request a document belonging to another account by changing the document identifier.
02 / Change: The download endpoint checks that the signed-in account is authorised to access the requested document before returning any file content.
03 / Verification: Using two test accounts, the owner's download succeeds. The other account is denied access without receiving file content. A signed-out request is also denied.
04 / Evidence & limits: The handover would include the change reference, test environment, dated results and redacted responses. This check covers the download endpoint; other document routes and an independent retest remain separate scope.

Connected systems. Connected security.

Identity, data, applications and infrastructure depend on each other. Explore the sixteen pieces to see how we approach the whole system.

Select a piece to see what it stands for — and what it takes to put it right.

The whole picture

A weakness rarely stays in one place. Understanding the connections is how we turn individual fixes into a stronger system.

Understand → Prioritise → Fix → VerifyEvery piece matters.