Methodology
How an engagement works
Every engagement follows the same disciplined path, from the first call to the report and, if you choose, the final retest. It is authorized, scoped in writing and confidential from start to finish.
Engagement steps
- 01
Scoping call and NDA
We learn how your service is built and delivered, agree what is in scope, and sign a mutual NDA before any technical detail changes hands.
- 02
Authorization and rules of engagement
You give written authorization for the agreed scope. Rules of engagement set out test accounts, timing, contacts and anything that is off limits.
- 03
Assessment by specialists
Work is divided by category, so each part of your delivery chain is examined by the engineer who specializes in it, on every platform in scope.
- 04
AI-assisted final sweep
Once the team’s work is complete, an AI-assisted review checks the whole picture again, looking for anything that slipped between categories.
- 05
Report and walkthrough
You receive the full report: every finding with evidence, severity and impact, and the step-by-step plan to close it. We walk your team through it.
- 06
Optional hardening and verification
If you choose, we implement the fixes with your team, then verify each one by testing it the way it was originally broken.
Principles
How we work with you
These hold for every engagement, whatever its size.
- Authorized work only
- We test only what you have authorized in writing, and never a service we have not been engaged to assess.
- No impact on your viewers
- Testing is planned to avoid disruption to production and to the people watching your content.
- Confidential by default
- Findings are shared only with you. Evidence is handled confidentially and deleted on request.
- Precision over checklists
- Every finding is demonstrated, and every recommendation is specific to your stack.
Severity
How we rate findings
Every finding gets one of four ratings, based on how easily it can be exploited and what it exposes. The rating sets the order of the hardening roadmap.
| Rating | What it means |
|---|---|
| Critical | Premium content can be extracted at full quality with little effort, using publicly available tools. |
| High | Content can be extracted, but it takes specialist effort or specific devices, or yields lower quality. |
| Medium | A weakness that does not expose content on its own, but makes another attack easier or harder to detect. |
| Low | A gap in hardening or monitoring with limited direct impact, worth fixing as part of routine work. |
Request an assessment
Find every path to your content, then close each one.
Tell us about your platforms and we’ll propose a scope and timeline for an assessment.
All engagements are conducted under NDA.