If we do not find a critical or high severity issue that your existing tooling missed, we do not send an invoice. People assume there is a catch in the definition. There is a definition, so here it is in full.
What “confirmed” means
A confirmed finding is one that was re-exploited before you saw it. Bhedan proposes a candidate. A named offensive engineer attempts it, captures the call that produced the result, and captures the confirming response. If that fails to reproduce, it is not a finding. It does not become a lower-severity finding, and it does not become a paragraph of hedged prose. It goes into the section stating what we could not prove.
So the invoice condition is not “we wrote something down”. It is “we produced evidence you can re-run against us”.
Why we structure it this way
The penetration testing market has a measurement problem. The buyer cannot easily tell a thorough test from a shallow one, because both produce a document, and the document is the product. That asymmetry rewards volume: more findings, more pages, more severity inflation, none of it costly to the seller.
Tying payment to confirmed exploitation removes our incentive to inflate and adds a real one to actually find things. If we pad the report, we have not moved the invoice. If we find nothing, we absorb the cost of the engagement.
What it means in practice
- You know before you commit what failure costs you: nothing, apart from the time your team spends on scoping.
- You still receive the full report if we find nothing, including the explicit statement of what we did not prove. That report has value to an auditor whether or not it contains findings.
- The paid pilot, three to five business days, is credited in full against your annual penetration test.
The refusal underneath it
This model only works if one thing is never negotiable: we refuse a fabricated finding, metric, credential or customer. Zero tolerance, on our side, applied to us. A commercial promise that depends on our honesty is worth exactly as much as the mechanism that keeps us honest, which is why every finding ships with the evidence to check it.
Scoping a pilot: support@tipstosecure.com.
