This form goes to a principal, not a sales queue. The first reply is almost always a short list of questions, because a price quoted before the scope is known is a guess with a decimal point on it.
What the system is and what it is built on. How many distinct user roles it has. Whether it is live and carrying real data. Who is asking you to prove it is safe — an auditor, a customer's security review, a regulator, your board. Any date you are working back from. And whether a previous test exists, because we read the old report before we quote the new one.
Written authorization is not a formality we add at signature. Until the scope document names the systems and the window, and someone with authority over those systems has signed it, there is nothing for us to test.
Not from a form. The number depends on the surfaces, how many roles get tested, whether it is live, and how deep you want to go. We scope that in writing first, and the scope carries the day count before you see an invoice line.
Then write what someone asked you for. “Our customer wants a pen test report” or “a laptop was compromised and legal wants to know what left” is enough for us to tell you which piece of work it actually is.
Not here — this form takes text only. Say that you have one, ask for the mutual NDA in the same message, and we will arrange somewhere to send it once that is signed.
Say that in the first line and send it. Then mail [email protected] directly rather than waiting on the form, and do not wipe or rebuild the affected machine before someone has imaged it.
Straight to email at [email protected]. The site does not store message content in a database. The email carries what you typed plus the address the form was submitted from, and the page keeps a short-lived record of submission times to throttle bots.
Only with written authorization from whoever does own it. If the system belongs to a vendor or a cloud tenant you share, we will tell you whose signature we need before the scope is drafted.
CobaltLoom