{"id":11,"date":"2026-10-07T18:11:31","date_gmt":"2026-10-07T18:11:31","guid":{"rendered":"https:\/\/dialecticsecurity.com\/?page_id=11"},"modified":"2026-10-07T20:41:29","modified_gmt":"2026-10-07T20:41:29","slug":"home","status":"publish","type":"page","link":"https:\/\/dialecticsecurity.com\/","title":{"rendered":"Home"},"content":{"rendered":"\n<section class=\"wp-block-group ds-hero is-layout-flow wp-block-group-is-layout-flow\">\n<figure class=\"wp-block-image size-full ds-hero-art\"><img decoding=\"async\" fetchpriority=\"high\" height=\"765\" loading=\"eager\" sizes=\"100vw\" srcset=\"https:\/\/dialecticsecurity.com\/wp-content\/themes\/dialectic-signal-pro\/assets\/images\/signal-field-small.webp 1100w, https:\/\/dialecticsecurity.com\/wp-content\/themes\/dialectic-signal-pro\/assets\/images\/signal-field.webp 2056w\" width=\"2056\" src=\"https:\/\/dialecticsecurity.com\/wp-content\/themes\/dialectic-signal-pro\/assets\/images\/signal-field.webp\" alt=\"\"\/><\/figure>\n\n\n<div class=\"ds-scan-field\" aria-hidden=\"true\"><div class=\"ds-scan-line\"><\/div><\/div>\n\n\n<div class=\"wp-block-group ds-container ds-hero-content is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow ds-hero-eyebrow wp-block-paragraph\"><span class=\"ds-status-dot\" aria-hidden=\"true\"><\/span> OFFENSIVE THINKING. PRACTICAL SECURITY.<\/p>\n\n\n<h1 class=\"wp-block-heading ds-hero-title\">Assume nothing.<br><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-signal-color\">Test everything.<\/mark><\/h1>\n\n\n<p class=\"ds-hero-description wp-block-paragraph\">We challenge the assumptions behind your security. Find the weaknesses that matter. And turn evidence into a stronger defence.<\/p>\n\n\n<div class=\"wp-block-buttons ds-hero-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button ds-button-primary\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/dialecticsecurity.com\/?page_id=17&#038;lang=en\">Scope an assessment<\/a><\/div>\n\n\n<div class=\"wp-block-button ds-button-secondary\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/dialecticsecurity.com\/?page_id=13&#038;lang=en\">Explore our capabilities<\/a><\/div>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-hero-caption is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-mono wp-block-paragraph\">SIGNALS \/ SYSTEMS \/ ATTACK SURFACES<\/p>\n\n\n<p class=\"ds-caption-copy wp-block-paragraph\">Look closer. There is always another layer.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-container ds-hero-rail is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-mono wp-block-paragraph\"><span>01 \/<\/span> CHALLENGE THE ASSUMPTION<\/p>\n\n\n<p class=\"ds-mono wp-block-paragraph\"><span>02 \/<\/span> FOLLOW THE EVIDENCE<\/p>\n\n\n<p class=\"ds-mono wp-block-paragraph\"><span>03 \/<\/span> STRENGTHEN THE SYSTEM<\/p>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group ds-intro is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-container ds-intro-grid is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-intro-lead is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow wp-block-paragraph\">THE DIALECTIC<\/p>\n\n\n<h2 class=\"wp-block-heading ds-intro-title\">Security is a dialogue.<br>Evidence moves it forward.<\/h2>\n\n<\/div>\n\n\n<p class=\"ds-intro-copy wp-block-paragraph\">Good security starts with better questions. What can an attacker reach? Which controls actually hold? What needs to change? We connect hands-on testing with decisions your team can act on.<\/p>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group ds-section ds-capabilities is-layout-flow wp-block-group-is-layout-flow\" id=\"capabilities\">\n<div class=\"wp-block-group ds-container is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-section-head is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow wp-block-paragraph\">01 \/ CAPABILITIES<\/p>\n\n\n<h2 class=\"wp-block-heading ds-section-title\">Find the weakness.<br>Make the fix count.<\/h2>\n\n<\/div>\n\n\n<p class=\"ds-mono ds-side-note wp-block-paragraph\">TECHNICAL DEPTH.<br>CLEAR DECISIONS.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-capability-grid is-layout-flow wp-block-group-is-layout-flow\">\n<article class=\"wp-block-group ds-capability-card is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-card-top is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-card-index wp-block-paragraph\">01<\/p>\n\n\n<\/div>\n\n\n<h3 class=\"wp-block-heading ds-card-title\">Offensive security<\/h3>\n\n\n<p class=\"dsc-purpose-label\">The focus<\/p><p class=\"ds-card-copy wp-block-paragraph\">Find the path an attacker would take. Test the weakness, understand the impact, and prioritise the fix.<\/p>\n\n\n<details class=\"wp-block-details ds-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Inside the scope<\/summary>\n\n<p class=\"ds-detail-copy wp-block-paragraph\">Applications, infrastructure and agreed attack paths. Evidence-led findings with remediation priorities and retesting defined in the engagement scope.<\/p>\n\n<\/details>\n\n\n<p class=\"ds-card-tags wp-block-paragraph\">Penetration testing \u00b7 Threat modelling \u00b7 Red team exercises<\/p>\n\n<p class=\"ds-service-link wp-block-paragraph\"><a href=\"https:\/\/dialecticsecurity.com\/?page_id=23&#038;lang=en\">Explore this capability<\/a><\/p>\n\n\n<\/article>\n\n\n<article class=\"wp-block-group ds-capability-card is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-card-top is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-card-index wp-block-paragraph\">02<\/p>\n\n\n<\/div>\n\n\n<h3 class=\"wp-block-heading ds-card-title\">Threat &#038; exposure intelligence<\/h3>\n\n\n<p class=\"dsc-purpose-label\">The focus<\/p><p class=\"ds-card-copy wp-block-paragraph\">Separate credible exposure from background noise. Put external threats and data leaks into context.<\/p>\n\n\n<details class=\"wp-block-details ds-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Inside the scope<\/summary>\n\n<p class=\"ds-detail-copy wp-block-paragraph\">A focused view of threats relevant to your organisation, with source context and practical investigation or remediation steps.<\/p>\n\n<\/details>\n\n\n<p class=\"ds-card-tags wp-block-paragraph\">Threat intelligence \u00b7 Data leak analysis \u00b7 Exposure review<\/p>\n\n<p class=\"ds-service-link wp-block-paragraph\"><a href=\"https:\/\/dialecticsecurity.com\/?page_id=25&#038;lang=en\">Explore this capability<\/a><\/p>\n\n\n<\/article>\n\n\n<article class=\"wp-block-group ds-capability-card is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-card-top is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-card-index wp-block-paragraph\">03<\/p>\n\n\n<\/div>\n\n\n<h3 class=\"wp-block-heading ds-card-title\">Detection engineering<\/h3>\n\n\n<p class=\"dsc-purpose-label\">The focus<\/p><p class=\"ds-card-copy wp-block-paragraph\">Make the signals worth watching visible. Strengthen monitoring around the activity that matters.<\/p>\n\n\n<details class=\"wp-block-details ds-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Inside the scope<\/summary>\n\n<p class=\"ds-detail-copy wp-block-paragraph\">Review telemetry coverage, detection logic and alert handling. Agree the monitoring model and operational responsibilities before implementation.<\/p>\n\n<\/details>\n\n\n<p class=\"ds-card-tags wp-block-paragraph\">Log analysis \u00b7 Detection review \u00b7 Monitoring design<\/p>\n\n<p class=\"ds-service-link wp-block-paragraph\"><a href=\"https:\/\/dialecticsecurity.com\/?page_id=27&#038;lang=en\">Explore this capability<\/a><\/p>\n\n\n<\/article>\n\n\n<article class=\"wp-block-group ds-capability-card is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-card-top is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-card-index wp-block-paragraph\">04<\/p>\n\n\n<\/div>\n\n\n<h3 class=\"wp-block-heading ds-card-title\">Incident response<\/h3>\n\n\n<p class=\"dsc-purpose-label\">The focus<\/p><p class=\"ds-card-copy wp-block-paragraph\">Move from uncertainty to an informed response. Investigate the event and support containment and recovery.<\/p>\n\n\n<details class=\"wp-block-details ds-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Inside the scope<\/summary>\n\n<p class=\"ds-detail-copy wp-block-paragraph\">An agreed response scope, evidence-handling approach and communication plan. Availability and response terms are confirmed directly, not assumed.<\/p>\n\n<\/details>\n\n\n<p class=\"ds-card-tags wp-block-paragraph\">Incident investigation \u00b7 Forensics \u00b7 Recovery support<\/p>\n\n<p class=\"ds-service-link wp-block-paragraph\"><a href=\"https:\/\/dialecticsecurity.com\/?page_id=29&#038;lang=en\">Explore this capability<\/a><\/p>\n\n\n<\/article>\n\n\n<article class=\"wp-block-group ds-capability-card is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-card-top is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-card-index wp-block-paragraph\">05<\/p>\n\n\n<\/div>\n\n\n<h3 class=\"wp-block-heading ds-card-title\">Connected &#038; physical systems<\/h3>\n\n\n<p class=\"dsc-purpose-label\">The focus<\/p><p class=\"ds-card-copy wp-block-paragraph\">Look beyond the browser. Review the devices, access systems and integrations your operations depend on.<\/p>\n\n\n<details class=\"wp-block-details ds-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Inside the scope<\/summary>\n\n<p class=\"ds-detail-copy wp-block-paragraph\">Connected-device platforms, fleet management, access-control and surveillance integrations. Specialist hardware or communications testing requires a separately agreed scope.<\/p>\n\n<\/details>\n\n\n<p class=\"ds-card-tags wp-block-paragraph\">Connected systems \u00b7 Fleet platforms \u00b7 Physical access<\/p>\n\n<p class=\"ds-service-link wp-block-paragraph\"><a href=\"https:\/\/dialecticsecurity.com\/?page_id=31&#038;lang=en\">Explore this capability<\/a><\/p>\n\n\n<\/article>\n\n\n<article class=\"wp-block-group ds-capability-card is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-card-top is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-card-index wp-block-paragraph\">06<\/p>\n\n\n<\/div>\n\n\n<h3 class=\"wp-block-heading ds-card-title\">Governance &#038; readiness<\/h3>\n\n\n<p class=\"dsc-purpose-label\">The focus<\/p><p class=\"ds-card-copy wp-block-paragraph\">Translate technical risk into decisions. Build governance that supports the way your organisation actually works.<\/p>\n\n\n<details class=\"wp-block-details ds-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Inside the scope<\/summary>\n\n<p class=\"ds-detail-copy wp-block-paragraph\">Risk assessment, security priorities and evidence-backed readiness work. Applicable obligations and deliverables are established for each engagement; no blanket compliance guarantees.<\/p>\n\n<\/details>\n\n\n<p class=\"ds-card-tags wp-block-paragraph\">vCISO \u00b7 Governance \u00b7 Saudi compliance readiness<\/p>\n\n<p class=\"ds-service-link wp-block-paragraph\"><a href=\"https:\/\/dialecticsecurity.com\/?page_id=33&#038;lang=en\">Explore this capability<\/a><\/p>\n\n\n<\/article>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group ds-section ds-method is-layout-flow wp-block-group-is-layout-flow\" id=\"approach\">\n<div class=\"wp-block-group ds-container ds-method-grid is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-method-left is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-method-intro is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow wp-block-paragraph\">02 \/ OUR APPROACH<\/p>\n\n\n<h2 class=\"wp-block-heading ds-section-title\">Challenge.<br>Test. Resolve.<\/h2>\n\n\n<p class=\"ds-section-copy wp-block-paragraph\">Not a scanner export. Not a stack of generic recommendations. A focused engagement built around your systems, your risk and the decisions you need to make.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-protocol is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow wp-block-paragraph\">THE ENGAGEMENT PROTOCOL<\/p>\n\n\n<div class=\"wp-block-group ds-protocol-line is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-protocol-label wp-block-paragraph\">SCOPE<\/p>\n\n\n<p class=\"ds-protocol-value wp-block-paragraph\">Agreed boundaries<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-protocol-line is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-protocol-label wp-block-paragraph\">TEST<\/p>\n\n\n<p class=\"ds-protocol-value wp-block-paragraph\">Authorised activity<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-protocol-line is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-protocol-label wp-block-paragraph\">OUTPUT<\/p>\n\n\n<p class=\"ds-protocol-value wp-block-paragraph\">Documented evidence<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-protocol-line is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-protocol-label wp-block-paragraph\">VERIFY<\/p>\n\n\n<p class=\"ds-protocol-value wp-block-paragraph\">Retest the finding<\/p>\n\n<\/div>\n\n\n<p class=\"ds-protocol-caption wp-block-paragraph\">Written scope. Actionable findings.<\/p>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-method-steps is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-step is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-step-number wp-block-paragraph\">01<\/p>\n\n\n<div class=\"wp-block-group ds-step-text is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Define the boundaries.<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Agree the assets, objectives, authorisation and rules of engagement before any testing begins.<\/p>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-step is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-step-number wp-block-paragraph\">02<\/p>\n\n\n<div class=\"wp-block-group ds-step-text is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Test the assumption.<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Investigate how the system behaves in practice. Validate findings and trace the meaningful attack paths.<\/p>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-step is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-step-number wp-block-paragraph\">03<\/p>\n\n\n<div class=\"wp-block-group ds-step-text is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Make the evidence usable.<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Explain what happened, why it matters and what to fix. Give technical teams detail and leadership a clear decision.<\/p>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-step is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-step-number wp-block-paragraph\">04<\/p>\n\n\n<div class=\"wp-block-group ds-step-text is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Verify the change.<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Agree remediation support and retesting. Check the fixes against the original finding, not just the checklist.<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n<section id=\"ds-sample-finding\" class=\"dsi dsi-finding alignfull wp-block-dialectic-interactive-sample-finding\" lang=\"en\" dir=\"ltr\" data-dsi-type=\"finding\" aria-labelledby=\"dsi-finding-1-heading\"><div class=\"dsi-container\"><header class=\"dsi-section-head\"><div><p class=\"dsi-eyebrow\">02 \/ INSIDE A FINDING<\/p><h2 id=\"dsi-finding-1-heading\">Evidence. Not just a score.<\/h2><\/div><p class=\"dsi-intro\">Explore a fictional finding from impact through to a verified correction.<\/p><\/header><div hidden data-dsi-config=\"{&quot;lang&quot;:&quot;en&quot;,&quot;common&quot;:{&quot;brand&quot;:&quot;DIALECTIC \\\/ INTERACTIVE&quot;,&quot;demo&quot;:&quot;ILLUSTRATIVE LAB \\u00b7 NOT A LIVE TEST&quot;,&quot;local&quot;:&quot;Synthetic data. No scanning, radio transmission or live target.&quot;,&quot;copy&quot;:&quot;Copy&quot;,&quot;copied&quot;:&quot;Copied to clipboard.&quot;,&quot;copyFail&quot;:&quot;Copy was blocked by your browser. Select the text below and copy it manually.&quot;,&quot;reset&quot;:&quot;Reset&quot;,&quot;motion&quot;:&quot;Reduce motion&quot;,&quot;nojs&quot;:&quot;JavaScript is off. The explanation is available below; interactive controls need JavaScript.&quot;,&quot;source&quot;:&quot;Technical reference&quot;},&quot;finding&quot;:{&quot;eyebrow&quot;:&quot;02 \\\/ INSIDE A FINDING&quot;,&quot;title&quot;:&quot;Evidence. Not just a score.&quot;,&quot;intro&quot;:&quot;Explore a fictional finding from impact through to a verified correction.&quot;,&quot;badge&quot;:&quot;SAMPLE DELIVERABLE \\\/ FICTIONAL&quot;,&quot;name&quot;:&quot;Cross-tenant invoice access&quot;,&quot;id&quot;:&quot;DS-LAB-001&quot;,&quot;classification&quot;:&quot;Object-level authorisation&quot;,&quot;audience&quot;:&quot;Reading level&quot;,&quot;executive&quot;:&quot;Executive&quot;,&quot;technical&quot;:&quot;Technical&quot;,&quot;tabs&quot;:[&quot;Impact&quot;,&quot;Evidence&quot;,&quot;Remediation&quot;,&quot;Verification&quot;],&quot;static&quot;:&quot;Read the complete sample&quot;,&quot;copy&quot;:&quot;Copy this section&quot;,&quot;note&quot;:&quot;No client data. No assigned CVSS score. Severity and remediation priorities depend on the actual scope and business context.&quot;,&quot;panelLabel&quot;:&quot;Finding detail&quot;,&quot;sections&quot;:[{&quot;id&quot;:&quot;impact&quot;,&quot;heading&quot;:&quot;One account should not expose another.&quot;,&quot;executive&quot;:&quot;In this example, a signed-in customer can read an invoice belonging to another customer. That creates a confidentiality failure across accounts. The sample does not establish access to all invoices or prove that any real customer was affected.&quot;,&quot;technical&quot;:&quot;The illustrative read endpoint authenticates the session but omits object-level authorisation. A tenant A principal receives a tenant B record for an action that policy should deny. Only the shown read path is demonstrated; write access and bulk enumeration are not established.&quot;,&quot;artifact&quot;:&quot;Scope demonstrated: one cross-tenant read\\nData: synthetic invoice\\nNot established: write access or full dataset exposure&quot;},{&quot;id&quot;:&quot;evidence&quot;,&quot;heading&quot;:&quot;Keep the proof precise.&quot;,&quot;executive&quot;:&quot;A controlled test uses two isolated customer accounts and a synthetic invoice. The expected outcome is an access denial. The vulnerable example instead returns the other account\\u2019s invoice.&quot;,&quot;technical&quot;:&quot;Authenticate as the tenant A test principal and request the known tenant B fixture INV-2049. Compare the expected authorisation decision with the response and record the actor, action, object and relevant policy. The HTTP excerpts are illustrative, not captured production traffic.&quot;,&quot;artifact&quot;:&quot;Actor:  tenant-a test principal\\nObject: INV-2049 \\\/ tenant-b\\nAction: read\\nExpected: DENY\\nObserved in the lab: 200 OK + record&quot;},{&quot;id&quot;:&quot;remediation&quot;,&quot;heading&quot;:&quot;Fix the decision, not the identifier.&quot;,&quot;executive&quot;:&quot;Require the system to confirm that the user is permitted to access the specific record before returning it. Test this consistently across customer boundaries and user roles.&quot;,&quot;technical&quot;:&quot;Enforce authorisation server-side for every relevant action and object. Use a policy-aware lookup or a central policy check before serialisation. Changing record IDs to UUIDs or hiding the button is not a substitute. Review related read, list, export and write paths rather than assuming one patch covers them.&quot;,&quot;artifact&quot;:&quot;request \\u2192 authenticate \\u2192 authorise(actor, action, object)\\n        \\u2192 deny on policy failure\\n        \\u2192 return permitted data only&quot;},{&quot;id&quot;:&quot;verification&quot;,&quot;heading&quot;:&quot;Prove the denial. Preserve the legitimate path.&quot;,&quot;executive&quot;:&quot;Retest both sides: a different customer must be blocked, and the permitted customer must still be able to read the invoice. Review related paths separately before expanding the assurance claim.&quot;,&quot;technical&quot;:&quot;Add cross-tenant negative tests and authorised positive controls. Check role boundaries, unauthenticated requests and related endpoints within the agreed scope. In this fictional retest, the cross-tenant read returns 403 and the authorised read returns 200; a design may instead return 404 to avoid disclosing existence.&quot;,&quot;artifact&quot;:&quot;Cross-tenant read: 403 \\\/ denied\\nAuthorised read:   200 \\\/ allowed\\nRelated endpoints: separate test coverage required&quot;}]}}\"><\/div><div class=\"dsi-finding-shell\">\n <div class=\"dsi-finding-identity\"><div><p class=\"dsi-label\">SAMPLE DELIVERABLE \/ FICTIONAL<\/p><h3>Cross-tenant invoice access<\/h3><p class=\"dsi-micro\">Object-level authorisation<\/p><\/div><span class=\"dsi-finding-id\" dir=\"ltr\">DS-LAB-001<\/span><\/div>\n <div class=\"dsi-finding-tools\" data-dsi-controls hidden><div class=\"dsi-tabs\" aria-label=\"Finding detail\" data-dsi-tabs><button type=\"button\" id=\"dsi-finding-1-tab-0\" data-dsi-tab=\"0\" aria-controls=\"dsi-finding-1-panel-0\">Impact<\/button><button type=\"button\" id=\"dsi-finding-1-tab-1\" data-dsi-tab=\"1\" aria-controls=\"dsi-finding-1-panel-1\">Evidence<\/button><button type=\"button\" id=\"dsi-finding-1-tab-2\" data-dsi-tab=\"2\" aria-controls=\"dsi-finding-1-panel-2\">Remediation<\/button><button type=\"button\" id=\"dsi-finding-1-tab-3\" data-dsi-tab=\"3\" aria-controls=\"dsi-finding-1-panel-3\">Verification<\/button><\/div><div class=\"dsi-audience\" role=\"group\" aria-label=\"Reading level\"><button type=\"button\" data-dsi-audience=\"executive\" aria-pressed=\"true\">Executive<\/button><button type=\"button\" data-dsi-audience=\"technical\" aria-pressed=\"false\">Technical<\/button><\/div><\/div>\n <div class=\"dsi-finding-panel\" data-dsi-panel=\"0\" id=\"dsi-finding-1-panel-0\"><div class=\"dsi-finding-copy\"><span class=\"dsi-panel-number\" aria-hidden=\"true\">01<\/span><p class=\"dsi-label\">Impact<\/p><h4>One account should not expose another.<\/h4><p data-dsi-reading=\"executive\">In this example, a signed-in customer can read an invoice belonging to another customer. That creates a confidentiality failure across accounts. The sample does not establish access to all invoices or prove that any real customer was affected.<\/p><p data-dsi-reading=\"technical\">The illustrative read endpoint authenticates the session but omits object-level authorisation. A tenant A principal receives a tenant B record for an action that policy should deny. Only the shown read path is demonstrated; write access and bulk enumeration are not established.<\/p><\/div><div class=\"dsi-finding-artifact\"><p class=\"dsi-label\" dir=\"ltr\">DS-LAB-001 \/ 01<\/p><pre tabindex=\"0\" dir=\"ltr\"><code>Scope demonstrated: one cross-tenant read\nData: synthetic invoice\nNot established: write access or full dataset exposure<\/code><\/pre><\/div><\/div><div class=\"dsi-finding-panel\" data-dsi-panel=\"1\" id=\"dsi-finding-1-panel-1\"><div class=\"dsi-finding-copy\"><span class=\"dsi-panel-number\" aria-hidden=\"true\">02<\/span><p class=\"dsi-label\">Evidence<\/p><h4>Keep the proof precise.<\/h4><p data-dsi-reading=\"executive\">A controlled test uses two isolated customer accounts and a synthetic invoice. The expected outcome is an access denial. The vulnerable example instead returns the other account\u2019s invoice.<\/p><p data-dsi-reading=\"technical\">Authenticate as the tenant A test principal and request the known tenant B fixture INV-2049. Compare the expected authorisation decision with the response and record the actor, action, object and relevant policy. The HTTP excerpts are illustrative, not captured production traffic.<\/p><\/div><div class=\"dsi-finding-artifact\"><p class=\"dsi-label\" dir=\"ltr\">DS-LAB-001 \/ 02<\/p><pre tabindex=\"0\" dir=\"ltr\"><code>Actor:  tenant-a test principal\nObject: INV-2049 \/ tenant-b\nAction: read\nExpected: DENY\nObserved in the lab: 200 OK + record<\/code><\/pre><\/div><\/div><div class=\"dsi-finding-panel\" data-dsi-panel=\"2\" id=\"dsi-finding-1-panel-2\"><div class=\"dsi-finding-copy\"><span class=\"dsi-panel-number\" aria-hidden=\"true\">03<\/span><p class=\"dsi-label\">Remediation<\/p><h4>Fix the decision, not the identifier.<\/h4><p data-dsi-reading=\"executive\">Require the system to confirm that the user is permitted to access the specific record before returning it. Test this consistently across customer boundaries and user roles.<\/p><p data-dsi-reading=\"technical\">Enforce authorisation server-side for every relevant action and object. Use a policy-aware lookup or a central policy check before serialisation. Changing record IDs to UUIDs or hiding the button is not a substitute. Review related read, list, export and write paths rather than assuming one patch covers them.<\/p><\/div><div class=\"dsi-finding-artifact\"><p class=\"dsi-label\" dir=\"ltr\">DS-LAB-001 \/ 03<\/p><pre tabindex=\"0\" dir=\"ltr\"><code>request \u2192 authenticate \u2192 authorise(actor, action, object)\n        \u2192 deny on policy failure\n        \u2192 return permitted data only<\/code><\/pre><\/div><\/div><div class=\"dsi-finding-panel\" data-dsi-panel=\"3\" id=\"dsi-finding-1-panel-3\"><div class=\"dsi-finding-copy\"><span class=\"dsi-panel-number\" aria-hidden=\"true\">04<\/span><p class=\"dsi-label\">Verification<\/p><h4>Prove the denial. Preserve the legitimate path.<\/h4><p data-dsi-reading=\"executive\">Retest both sides: a different customer must be blocked, and the permitted customer must still be able to read the invoice. Review related paths separately before expanding the assurance claim.<\/p><p data-dsi-reading=\"technical\">Add cross-tenant negative tests and authorised positive controls. Check role boundaries, unauthenticated requests and related endpoints within the agreed scope. In this fictional retest, the cross-tenant read returns 403 and the authorised read returns 200; a design may instead return 404 to avoid disclosing existence.<\/p><\/div><div class=\"dsi-finding-artifact\"><p class=\"dsi-label\" dir=\"ltr\">DS-LAB-001 \/ 04<\/p><pre tabindex=\"0\" dir=\"ltr\"><code>Cross-tenant read: 403 \/ denied\nAuthorised read:   200 \/ allowed\nRelated endpoints: separate test coverage required<\/code><\/pre><\/div><\/div> <div class=\"dsi-finding-footer\"><p class=\"dsi-micro\">No client data. No assigned CVSS score. Severity and remediation priorities depend on the actual scope and business context.<\/p><button type=\"button\" class=\"dsi-text-button\" data-dsi-copy-finding hidden>Copy this section<\/button><\/div><p class=\"dsi-feedback\" data-dsi-feedback role=\"status\" aria-atomic=\"true\"><\/p>\n<\/div>\n<\/div><\/section>\n\n<section class=\"wp-block-group ds-section ds-research is-layout-flow wp-block-group-is-layout-flow\" id=\"research\">\n<div class=\"wp-block-group ds-container is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-section-head is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow wp-block-paragraph\">03 \/ FIELD NOTES<\/p>\n\n\n<h2 class=\"wp-block-heading ds-section-title\">From the workbench.<\/h2>\n\n<\/div>\n\n\n<p class=\"ds-side-note wp-block-paragraph\">Investigations, engineering<br>and lessons from the field.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-query ds-research-query is-layout-flow wp-block-query-is-layout-flow\"><ul class=\"ds-notes-grid wp-block-post-template is-layout-flow wp-block-post-template-is-layout-flow\"><li class=\"wp-block-post post-113 post type-post status-publish format-standard has-post-thumbnail hentry category-uncategorized-en\">\n<figure class=\"ds-note-image wp-block-post-featured-image\"><a href=\"https:\/\/dialecticsecurity.com\/?p=113\" target=\"_self\" ><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Dalail-Storyboard-1024x683.png\" class=\"attachment-large size-large wp-post-image\" alt=\"Dalail.ai Security Assessment\" style=\"aspect-ratio:16\/9;width:100%;object-fit:cover;\" srcset=\"https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Dalail-Storyboard-1024x683.png 1024w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Dalail-Storyboard-300x200.png 300w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Dalail-Storyboard-768x512.png 768w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Dalail-Storyboard-1200x800.png 1200w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Dalail-Storyboard.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n<\/li><li class=\"wp-block-post post-97 post type-post status-publish format-standard has-post-thumbnail hentry category-uncategorized-en\">\n<figure class=\"ds-note-image wp-block-post-featured-image\"><a href=\"https:\/\/dialecticsecurity.com\/?p=97\" target=\"_self\" ><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Blue-Steel-Storyboard-1024x683.png\" class=\"attachment-large size-large wp-post-image\" alt=\"Blue-Steel Incident\" style=\"aspect-ratio:16\/9;width:100%;object-fit:cover;\" srcset=\"https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Blue-Steel-Storyboard-1024x683.png 1024w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Blue-Steel-Storyboard-300x200.png 300w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Blue-Steel-Storyboard-768x512.png 768w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Blue-Steel-Storyboard-1200x800.png 1200w, https:\/\/dialecticsecurity.com\/wp-content\/uploads\/2026\/10\/Blue-Steel-Storyboard.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n<\/li><\/ul>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n<section id=\"ds-assessment-brief\" class=\"dsi dsi-brief alignfull wp-block-dialectic-interactive-assessment-brief\" lang=\"en\" dir=\"ltr\" data-dsi-type=\"brief\" aria-labelledby=\"dsi-brief-2-heading\"><div class=\"dsi-container\"><header class=\"dsi-section-head\"><div><p class=\"dsi-eyebrow\">03 \/ START WITH THE RIGHT QUESTIONS<\/p><h2 id=\"dsi-brief-2-heading\">Shape the assessment.<\/h2><\/div><p class=\"dsi-intro\">A clearer scope makes a better first conversation. Build a short brief, then keep it or send it yourself.<\/p><\/header><div hidden data-dsi-config=\"{&quot;lang&quot;:&quot;en&quot;,&quot;common&quot;:{&quot;brand&quot;:&quot;DIALECTIC \\\/ INTERACTIVE&quot;,&quot;demo&quot;:&quot;ILLUSTRATIVE LAB \\u00b7 NOT A LIVE TEST&quot;,&quot;local&quot;:&quot;Synthetic data. No scanning, radio transmission or live target.&quot;,&quot;copy&quot;:&quot;Copy&quot;,&quot;copied&quot;:&quot;Copied to clipboard.&quot;,&quot;copyFail&quot;:&quot;Copy was blocked by your browser. Select the text below and copy it manually.&quot;,&quot;reset&quot;:&quot;Reset&quot;,&quot;motion&quot;:&quot;Reduce motion&quot;,&quot;nojs&quot;:&quot;JavaScript is off. The explanation is available below; interactive controls need JavaScript.&quot;,&quot;source&quot;:&quot;Technical reference&quot;},&quot;brief&quot;:{&quot;eyebrow&quot;:&quot;03 \\\/ START WITH THE RIGHT QUESTIONS&quot;,&quot;title&quot;:&quot;Shape the assessment.&quot;,&quot;intro&quot;:&quot;A clearer scope makes a better first conversation. Build a short brief, then keep it or send it yourself.&quot;,&quot;privacy&quot;:&quot;This tool has no submission endpoint. Your answers are not sent by this plugin; they remain in this page until you copy, download or open an email draft. Do not include secrets or personal data.&quot;,&quot;steps&quot;:[&quot;System&quot;,&quot;Objective&quot;,&quot;Context&quot;,&quot;Your brief&quot;],&quot;step&quot;:&quot;Step&quot;,&quot;of&quot;:&quot;of&quot;,&quot;back&quot;:&quot;Back&quot;,&quot;next&quot;:&quot;Continue&quot;,&quot;finish&quot;:&quot;Build my brief&quot;,&quot;restart&quot;:&quot;Start again&quot;,&quot;required&quot;:&quot;Choose an option to continue.&quot;,&quot;systemLabel&quot;:&quot;What are we looking at?&quot;,&quot;systemHint&quot;:&quot;Choose the closest fit. This is an enquiry, not a promise of scope or availability.&quot;,&quot;systems&quot;:[[&quot;app&quot;,&quot;Application \\\/ API&quot;],[&quot;infra&quot;,&quot;Infrastructure \\\/ cloud&quot;],[&quot;connected&quot;,&quot;Connected systems&quot;],[&quot;unsure&quot;,&quot;Help me define the scope&quot;]],&quot;goalLabel&quot;:&quot;What do you need to establish?&quot;,&quot;goals&quot;:[[&quot;release&quot;,&quot;Confidence before a release&quot;],[&quot;assurance&quot;,&quot;Independent security assurance&quot;],[&quot;retest&quot;,&quot;Verification after a fix&quot;],[&quot;explore&quot;,&quot;Understand what to test&quot;]],&quot;contextTitle&quot;:&quot;A little context. No sensitive details.&quot;,&quot;environmentLabel&quot;:&quot;Testing environment&quot;,&quot;environments&quot;:[[&quot;staging&quot;,&quot;Staging \\\/ test&quot;],[&quot;production&quot;,&quot;Production \\u2014 constraints to agree&quot;],[&quot;mixed&quot;,&quot;Mixed \\\/ not decided&quot;]],&quot;sizeLabel&quot;:&quot;Approximate scope&quot;,&quot;sizes&quot;:{&quot;app&quot;:[[&quot;one&quot;,&quot;One application or API&quot;],[&quot;few&quot;,&quot;Two to five applications \\\/ APIs&quot;],[&quot;many&quot;,&quot;Larger scope \\u2014 to discuss&quot;],[&quot;unknown&quot;,&quot;Not sure yet&quot;]],&quot;infra&quot;:[[&quot;one&quot;,&quot;One environment&quot;],[&quot;few&quot;,&quot;A few environments&quot;],[&quot;many&quot;,&quot;Larger estate \\u2014 to discuss&quot;],[&quot;unknown&quot;,&quot;Not sure yet&quot;]],&quot;connected&quot;:[[&quot;one&quot;,&quot;One product \\\/ device family&quot;],[&quot;few&quot;,&quot;Several components&quot;],[&quot;many&quot;,&quot;Wider system \\u2014 to discuss&quot;],[&quot;unknown&quot;,&quot;Not sure yet&quot;]],&quot;unsure&quot;:[[&quot;unknown&quot;,&quot;To be defined together&quot;]]},&quot;timingLabel&quot;:&quot;Preferred timing&quot;,&quot;timings&quot;:[[&quot;soon&quot;,&quot;As soon as practical&quot;],[&quot;quarter&quot;,&quot;Within three months&quot;],[&quot;flexible&quot;,&quot;Flexible \\\/ exploratory&quot;]],&quot;summaryTitle&quot;:&quot;Your assessment brief.&quot;,&quot;summaryIntro&quot;:&quot;Review this before sharing it. Nothing has been sent.&quot;,&quot;copy&quot;:&quot;Copy brief&quot;,&quot;download&quot;:&quot;Download .txt&quot;,&quot;email&quot;:&quot;Open email draft&quot;,&quot;emailNote&quot;:&quot;Opens your email app. Review the recipient and message there, then send. This page cannot confirm delivery.&quot;,&quot;emailUnavailable&quot;:&quot;Email drafting is not configured. Copy or download your brief and use the site\\u2019s contact page.&quot;,&quot;downloaded&quot;:&quot;Download requested. Nothing has been submitted.&quot;,&quot;emailOpened&quot;:&quot;An email draft was requested in your email app. Nothing was sent by this page.&quot;,&quot;checklistTitle&quot;:&quot;Before testing starts&quot;,&quot;checklist&quot;:[&quot;Confirm ownership and written authorisation.&quot;,&quot;Agree the assets, test window and operational constraints.&quot;,&quot;Define evidence handling, reporting and retest expectations.&quot;],&quot;disclaimer&quot;:&quot;Planning brief only. Not a quotation, booking, assessment result or authorisation to test.&quot;,&quot;briefTitle&quot;:&quot;DIALECTIC SECURITY \\\/ ASSESSMENT BRIEF&quot;,&quot;briefLabels&quot;:[&quot;System&quot;,&quot;Objective&quot;,&quot;Environment&quot;,&quot;Approximate scope&quot;,&quot;Preferred timing&quot;],&quot;nextStep&quot;:&quot;Next step: confirm scope, authorisation and rules of engagement with Dialectic Security.&quot;,&quot;noscript&quot;:&quot;To scope an assessment, note the system type, objective, environment, approximate size and timing. Share those details through the site\\u2019s contact page.&quot;},&quot;email&quot;:&quot;&quot;}\"><\/div><div class=\"dsi-brief-shell\">\n <aside class=\"dsi-brief-aside\"><span class=\"dsi-label\" dir=\"ltr\">DIALECTIC \/ ENGAGEMENT<\/span><ol class=\"dsi-brief-progress\" aria-label=\"Shape the assessment.\"><li data-dsi-progress=\"0\" aria-current=\"step\"><span aria-hidden=\"true\">01<\/span>System<\/li><li data-dsi-progress=\"1\"><span aria-hidden=\"true\">02<\/span>Objective<\/li><li data-dsi-progress=\"2\"><span aria-hidden=\"true\">03<\/span>Context<\/li><li data-dsi-progress=\"3\"><span aria-hidden=\"true\">04<\/span>Your brief<\/li><\/ol><p class=\"dsi-privacy\">This tool has no submission endpoint. Your answers are not sent by this plugin; they remain in this page until you copy, download or open an email draft. Do not include secrets or personal data.<\/p><\/aside>\n <div class=\"dsi-brief-content\"><p data-dsi-brief-fallback>To scope an assessment, note the system type, objective, environment, approximate size and timing. Share those details through the site\u2019s contact page.<\/p>\n <form data-dsi-brief-form hidden autocomplete=\"off\" novalidate>\n  <div class=\"dsi-form-step\" data-dsi-form-step=\"0\"><fieldset><legend tabindex=\"-1\">What are we looking at?<\/legend><p class=\"dsi-micro\">Choose the closest fit. This is an enquiry, not a promise of scope or availability.<\/p><div class=\"dsi-choice-grid\"><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-system\" value=\"app\" data-dsi-answer=\"system\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">01<\/span>Application \/ API<\/span><\/label><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-system\" value=\"infra\" data-dsi-answer=\"system\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">02<\/span>Infrastructure \/ cloud<\/span><\/label><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-system\" value=\"connected\" data-dsi-answer=\"system\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">03<\/span>Connected systems<\/span><\/label><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-system\" value=\"unsure\" data-dsi-answer=\"system\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">04<\/span>Help me define the scope<\/span><\/label><\/div><\/fieldset><\/div>\n  <div class=\"dsi-form-step\" data-dsi-form-step=\"1\" hidden><fieldset><legend tabindex=\"-1\">What do you need to establish?<\/legend><div class=\"dsi-choice-grid\"><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-goal\" value=\"release\" data-dsi-answer=\"goal\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">01<\/span>Confidence before a release<\/span><\/label><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-goal\" value=\"assurance\" data-dsi-answer=\"goal\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">02<\/span>Independent security assurance<\/span><\/label><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-goal\" value=\"retest\" data-dsi-answer=\"goal\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">03<\/span>Verification after a fix<\/span><\/label><label class=\"dsi-choice\"><input type=\"radio\" name=\"dsi-brief-2-goal\" value=\"explore\" data-dsi-answer=\"goal\" required><span><span class=\"dsi-choice-index\" aria-hidden=\"true\">04<\/span>Understand what to test<\/span><\/label><\/div><\/fieldset><\/div>\n  <div class=\"dsi-form-step\" data-dsi-form-step=\"2\" hidden><h3 tabindex=\"-1\">A little context. No sensitive details.<\/h3><label class=\"dsi-select-label\" for=\"dsi-brief-2-environment\">Testing environment<\/label><select id=\"dsi-brief-2-environment\" data-dsi-answer=\"environment\" required><option value=\"\">Choose an option<\/option><option value=\"staging\">Staging \/ test<\/option><option value=\"production\">Production \u2014 constraints to agree<\/option><option value=\"mixed\">Mixed \/ not decided<\/option><\/select><label class=\"dsi-select-label\" for=\"dsi-brief-2-size\">Approximate scope<\/label><select id=\"dsi-brief-2-size\" data-dsi-answer=\"size\" required><option value=\"\">Choose an option<\/option><\/select><label class=\"dsi-select-label\" for=\"dsi-brief-2-timing\">Preferred timing<\/label><select id=\"dsi-brief-2-timing\" data-dsi-answer=\"timing\" required><option value=\"\">Choose an option<\/option><option value=\"soon\">As soon as practical<\/option><option value=\"quarter\">Within three months<\/option><option value=\"flexible\">Flexible \/ exploratory<\/option><\/select><\/div>\n  <div class=\"dsi-form-step\" data-dsi-form-step=\"3\" hidden><h3 tabindex=\"-1\">Your assessment brief.<\/h3><p class=\"dsi-micro\">Review this before sharing it. Nothing has been sent.<\/p><textarea data-dsi-brief-output readonly rows=\"12\" aria-label=\"Your assessment brief.\" spellcheck=\"false\"><\/textarea><div class=\"dsi-actions\"><button type=\"button\" class=\"dsi-button dsi-primary\" data-dsi-copy-brief>Copy brief<\/button><button type=\"button\" class=\"dsi-button \" data-dsi-download-brief>Download .txt<\/button><\/div><p class=\"dsi-micro\">Email drafting is not configured. Copy or download your brief and use the site\u2019s contact page.<\/p><details class=\"dsi-details\"><summary>Before testing starts<\/summary><ul><li>Confirm ownership and written authorisation.<\/li><li>Agree the assets, test window and operational constraints.<\/li><li>Define evidence handling, reporting and retest expectations.<\/li><\/ul><\/details><p class=\"dsi-micro\">Planning brief only. Not a quotation, booking, assessment result or authorisation to test.<\/p><\/div>\n  <p class=\"dsi-error\" data-dsi-form-error role=\"alert\"><\/p><div class=\"dsi-form-navigation\"><button type=\"button\" class=\"dsi-button dsi-quiet\" data-dsi-back hidden>Back<\/button><span class=\"dsi-label\" data-dsi-step-count><\/span><button type=\"button\" class=\"dsi-button dsi-primary\" data-dsi-next>Continue<\/button><button type=\"button\" class=\"dsi-button \" data-dsi-restart hidden>Start again<\/button><\/div><p class=\"dsi-feedback\" data-dsi-feedback role=\"status\" aria-atomic=\"true\"><\/p>\n <\/form><\/div>\n<\/div>\n<\/div><\/section>\n<section class=\"wp-block-group ds-section ds-contact is-layout-flow wp-block-group-is-layout-flow\" id=\"contact\">\n<div class=\"wp-block-group ds-container ds-contact-grid is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group ds-contact-lead is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow wp-block-paragraph\">04 \/ START A CONVERSATION<\/p>\n\n\n<h2 class=\"wp-block-heading ds-contact-title\">What are you<br>working on?<\/h2>\n\n\n<p class=\"ds-contact-copy wp-block-paragraph\">A new application. A difficult security question. A system that needs a closer look. Let\u2019s define the right engagement.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button ds-button-primary\"><a class=\"wp-block-button__link wp-element-button\" dir=\"ltr\" href=\"mailto:info@dialecticsecurity.com\">Tell us what needs testing<\/a><\/div>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group ds-contact-info is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"ds-eyebrow wp-block-paragraph\">DIRECT CHANNEL<\/p>\n\n\n<p class=\"ds-contact-email wp-block-paragraph\"><a dir=\"ltr\" href=\"mailto:info@dialecticsecurity.com\">info@dialecticsecurity.com<\/a><\/p>\n\n\n<p class=\"ds-contact-phone wp-block-paragraph\"><a dir=\"ltr\" href=\"tel:+966550011781\">+966 55 001 1781<\/a><\/p>\n\n\n<p class=\"ds-contact-location wp-block-paragraph\">Jeddah, Saudi Arabia<\/p>\n\n\n<p class=\"ds-contact-note wp-block-paragraph\">Start with your objectives, the systems in scope and your preferred timing. Please do not send credentials, sensitive datasets or exploit details in an initial email.<\/p>\n\n\n<p class=\"ds-contact-privacy wp-block-paragraph\">Send a brief. Agree the scope.<br>Keep sensitive details off email.<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n","protected":false},"excerpt":{"rendered":"<p>We challenge the assumptions behind your security. Find the weaknesses that matter. And turn evidence into a stronger defence.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-canvas","meta":{"_wpcom_ai_launchpad_about_page":false,"_wpcom_ai_launchpad_gallery_page":false,"_wpcom_ai_launchpad_contact_page":false,"_wpcom_ai_launchpad_events_page":false,"_wpcom_ai_launchpad_video_page":false,"_wpcom_ai_launchpad_portfolio_piece":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"footnotes":""},"class_list":["post-11","page","type-page","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=\/wp\/v2\/pages\/11","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11"}],"version-history":[{"count":3,"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=\/wp\/v2\/pages\/11\/revisions"}],"predecessor-version":[{"id":119,"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=\/wp\/v2\/pages\/11\/revisions\/119"}],"wp:attachment":[{"href":"https:\/\/dialecticsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}