PREFLIGHT / ASSURANCE COMMAND CENTER
Verken beheerde technische methoden, specialistische beoordelingen en toekomstige laboratoriumtrajecten.
Vermelding betekent geen personeelsautorisatie, goedkeuring van apparatuur, accreditatie of klantspecifieke vrijgave.
Uitgebreide technische beschrijvingen zijn in het Engels.
The live LIMS register is the single source of truth. A controlled automation remains subject to frozen scope, accepted execution worker, approved method and QMS review. Human-led review requires personnel authorization. No listed pathway implies an accreditation, certification, external recognition, physical laboratory commissioning or security guarantee.
Original Preflight programmes combine complementary capabilities into written scopes. Programme availability refers to governed intake or preparation; only commissioned methods and authorized personnel may execute a test.
Security Audits
Threat modelling, manual vulnerability research, peer challenge, remediation verification and controlled reporting.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
7 mapped capabilities · research-audit
Security Audits
Bounded expert review with automated repository evidence and a short prioritized finding register.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
4 mapped capabilities · rapid-security-review
Security Audits
Authentication, authorization, session, browser, business-logic and API trust-boundary review.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
4 mapped capabilities · application-api-review
Security Audits
Review deployment, CI/CD, dependencies, secrets, provenance and build integrity under explicit repository authorization.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
4 mapped capabilities · cloud-supply-chain
Web3 Security
Manual contract review combined with structured tool evidence, governance and deployment consistency checks.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
4 mapped capabilities · contract-audit
Web3 Security
Assess lending, pools, vaults, oracle dependencies, economic assumptions and privileged controls.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
3 mapped capabilities · defi-economics
Web3 Security
Evaluate trust assumptions, message validation, settlement, chain operations and upgrade governance.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
3 mapped capabilities · bridge-rollup
Web3 Security
Review keys, wallet/account binding, user-approved transactions, signing procedures and recovery.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
4 mapped capabilities · wallet-assurance
Web3 Security
Specialist programme scoped subject to personnel competence and methodology authorization.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
4 mapped capabilities · chain-specialist
Formal Assurance
Write invariants and select validated proof methods with explicit assumptions and limitations.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
3 mapped capabilities · formal-specification
Formal Assurance
Design repeatable property-based testing and re-running proof/fuzz harnesses for controlled releases.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
3 mapped capabilities · formal-continuous
Cryptography & Identity
Specialist review of primitives, key lifecycle, threshold signing and recovery assumptions.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
3 mapped capabilities · cryptography-review
Cryptography & Identity
Map cryptographic dependencies, migration priorities and interoperability evidence without claiming quantum-resistant blockchain transactions.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · pqc-migration
Cryptography & Identity
Specialist review planning for prover/verifier boundaries, arithmetic constraints and circuit assumptions.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · zk-review
Cryptography & Identity
Prepare identity and authenticator technical evidence for a separately administered scheme.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · identity-fido
Cryptography & Identity
Prepare algorithm, module and entropy evidence without asserting CAVP/CMVP validation or accreditation.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
3 mapped capabilities · crypto-programmes
Laboratory Pathways
Commission methods, equipment, authorized personnel and traceable physical evidence before any live physical testing.
Physical laboratory commissioning required
Do not book or represent physical testing until equipment, methods, personnel and safety controls are accepted.
3 mapped capabilities · hardware-pathway
Laboratory Pathways
Prepare secure-boot, firmware, enclave, product-lifecycle and laboratory methods.
Physical laboratory commissioning required
Do not book or represent physical testing until equipment, methods, personnel and safety controls are accepted.
3 mapped capabilities · embedded-iot
Laboratory Pathways
Organize security target, method and evidence documentation for external evaluation pathways.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · scheme-product
AI & Operational Security
Threat-model agents, untrusted input, retrieval poisoning, data leakage and action authorization.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
4 mapped capabilities · ai-agent-review
AI & Operational Security
Review access, operational signing, administrative controls and incident procedures.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
4 mapped capabilities · operations-signer
Continuous Assurance
Govern incident intake, retained timeline, evidence, root cause, corrective actions and effectiveness checks.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
3 mapped capabilities · incident-response
Continuous Assurance
Prepare authorized transaction evidence capture and qualified investigation with explicit attribution uncertainty.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · incident-investigation
Continuous Assurance
Connect approved repositories, freeze release scope and track verification, vulnerabilities and drift over time.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
3 mapped capabilities · continuous-gate
Continuous Assurance
Set safe-harbor scope, submission intake, deduplication and remediation governance; specialist judging requires qualification.
Available for controlled scoping
A project-specific contract, personnel competence, approved methods and QMS controls remain mandatory.
3 mapped capabilities · research-challenge
Web3 Security
Prepare controlled, reproducible liquidity, oracle, MEV and liquidation scenarios.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · economic-modelling
Cryptography & Identity
Review technical disclosure and reconciliation assumptions; not a financial audit or attestation.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · proof-reserves
Laboratory Pathways
Prepare payment-control evidence for the named programme without recognized scheme status claims.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · payments-readiness
Security Audits
Define non-destructive authorized methods, rules of engagement and reviewer competence prior to execution.
Readiness and specialist scoping only
Method, qualifications or external programme prerequisites must be satisfied before technical delivery or recognition claims.
2 mapped capabilities · penetration-testing
100 capaciteiten gevonden
Capture client, authorization, service objective, confidentiality, exclusions and acceptance criteria before technical work begins.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
engagement-intake
Freeze repositories, branches, commits, deployed origins, contracts, exclusions and method authorization in the Preflight Engagement Manifest (PEM).
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
scope-freeze
Model assets, actors, trust boundaries, entry points, privileged paths, failure modes and abuse cases before deep review.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
threat-model
Research-led expert review for logic, design and emergent failure modes that automated tools cannot reliably infer.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
manual-vulnerability-research
Support maker-checker review, independent technical challenge and signatory separation for material conclusions.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
dual-review
Bind each proposed fix to the original finding, verify the changed code and retain before/after evidence.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
remediation-verification
Compare implemented behavior with written protocol, product and security requirements and record deviations.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
spec-conformance
Assemble evidence, findings, limitations, status and approvals into a controlled report released only through QMS governance.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
report-qms-release
Prepare evidence and readiness packs for separately granted external schemes without representing Preflight as accredited before grant.
Readiness support is not accreditation or certification. An external grant and exact scope are required before such claims can be made.
Bewijs en opleveringen
external-accreditation-workflow
Static source review for dangerous patterns, trust-boundary mistakes, injection surfaces and insecure configuration.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
repo-static-analysis
Review dependency manifests, lockfiles, package provenance and known-risk policy without changing the target repository.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Doorlopend assurance-traject
Bewijs en opleveringen
dependency-supply-chain
Detect likely committed credentials, private-key material and high-risk secret patterns in authorized source scope.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Doorlopend assurance-traject
Bewijs en opleveringen
secret-exposure-scan
Generate and validate component inventory, dependency boundaries and reproducibility evidence.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Doorlopend assurance-traject
Bewijs en opleveringen
sbom-integrity
Bounded testing of authentication, authorization, session expiry, fixation and privilege boundaries against an authorized origin.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
auth-session-validation
Rate-bounded malformed-input and parser-boundary testing against explicitly authorized scope without denial-of-service mode.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
input-boundary-fuzz
Controlled SSRF boundary tests for URL fetches and callbacks against explicit authorized origins.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
ssrf-defense-validation
Bounded replay, duplicate-submission, idempotency and TOCTOU validation with strict request ceilings.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
replay-race-validation
Schema-aware negative API testing for validation, authorization and error-handling defects.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
api-contract-fuzz
Review infrastructure-as-code, containers, CI/CD and deployment configuration for excessive privilege and unsafe defaults.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
iac-container-hardening
Trace critical user and financial workflows to find authorization gaps, impossible-state assumptions, sequence abuse and specification mismatches.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
business-logic-review
Review third-party services, SDKs, RPCs, APIs and data contracts for trust, compatibility and consistency failures.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
integration-risk-review
Review clarity, tests, error handling, dead code, unsafe defaults and maintainability as security-relevant engineering signals.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
code-maturity-review
Review origin assumptions, CORS, debug surfaces, proxy boundaries, headers and privileged internal/external transitions.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
trust-boundary-review
Review payload, decompression, pagination, queue, memory and rate-limit boundaries without destructive stress or denial-of-service execution.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
resource-safety-review
Expert browser/runtime review of navigation, iframe, postMessage, storage, CSP, wallet/provider and cross-origin behavior.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
web-dynamic-review
Review Android/iOS application architecture, storage, deep links, WebViews, IPC, permissions and platform security boundaries where in scope.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
mobile-app-review
Scope-controlled assessment of application, API and infrastructure weaknesses using bounded, non-destructive testing.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
authorized-penetration-testing
Authorized source analysis, invariant checks and local/testnet transaction simulation without value-moving mainnet execution.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
smart-contract-security
Pre-sign construction, recipient, chain, fee, debit and duplicate-submission validation in simulation/test environments.
A validation module exists. Actual execution still requires written scope, an accepted worker, method authorization and QMS review.
Bewijs en opleveringen
transaction-simulation
Review Solidity/Vyper/EVM semantics, assembly, bytecode behavior, precompiles and chain-specific edge cases.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
evm-deep-review
Review exchanges, lending, vaults, staking, oracles, stablecoins, liquidation and economic attack surfaces.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
defi-economic-review
Review message validation, proof assumptions, relayers, finality, replay, liquidity and cross-domain governance boundaries.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
bridge-crosschain-review
Review consensus-adjacent code, sequencers, nodes, system contracts, precompiles, proof/finality and upgrade boundaries.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
l1-l2-rollup-review
Review Move-specific type, resource, bytecode, arithmetic, execution and protocol invariants.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
move-security-review
Review account validation, signer/authority rules, CPI, arithmetic, PDA and runtime assumptions for Solana programs.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
solana-security-review
Review deterministic execution, consensus-affecting behavior, panics, resource bounds and module integration.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
cosmos-security-review
Review Cairo contracts and Starknet-specific account, messaging, arithmetic and protocol assumptions.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
cairo-starknet-review
Review ERC-4337/account-abstraction validation, paymasters, bundlers, nonce/replay controls, modules and recovery paths.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
account-abstraction-review
Review privileged roles, proxies, timelocks, emergency powers, parameter governance and bypass paths.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
governance-upgrade-review
Compare deployed bytecode, parameters, addresses and configuration with the exact reviewed artifacts to detect post-review drift.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Doorlopend assurance-traject
Bewijs en opleveringen
deployment-verification
Model liquidity, oracle, MEV, liquidation and parameter-shift scenarios against an explicitly frozen economic threat model.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
economic-exploit-simulation
Capture bounded simulation, invocation trees, state changes and value flow for authorized transactions; third-party explorer integrations require separate validation.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
transaction-tracing-simulator
Translate intended safety and correctness properties into explicit, reviewable invariants and formal rules.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
formal-specification
Explore program paths symbolically against defined security and correctness properties.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
symbolic-execution
Use SMT-backed verification to prove or refute defined properties over bounded or modeled program semantics.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
smt-proof
Prove contract properties against a controlled formal specification and retain rerunnable proof artifacts.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
contract-formal-verification
Verify safety/liveness properties over explicit protocol or workflow state models.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
model-checking
Re-run approved formal properties on material code changes and record proof drift as continuous assurance evidence.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
property-regression-ci
Design stateful properties and adversarial generators to exercise invariants beyond example-based test suites.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
property-based-testing
Compare implementations and protocol invariants under constrained test harnesses to identify divergent state transitions, crashes and parser failures.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
validator-runtime-fuzzing
Review protocol construction, primitive use, nonce/randomness, key derivation, signatures, encryption and implementation assumptions.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
applied-cryptography-review
Review circuit constraints, witness handling, proof assumptions and prover/verifier integration for ZK systems.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
zk-circuit-review
Review distributed key generation, signing ceremonies, participant assumptions, quorum, recovery and operational failure modes.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
mpc-tss-review
Review Shamir/threshold shares, storage, reconstruction, social recovery and compromise boundaries.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
secret-sharing-review
Review key lifecycle, custody boundary, signing intent, transaction display, recovery and compromise containment.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
wallet-key-boundary
Review identity binding, recovery factors, session transitions and account takeover resistance in assisted wallet flows.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
wallet-social-login
Review threshold, signer independence, payload binding, transaction verification and bypass paths.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
multisig-security
Inventory cryptographic dependencies and assess migration paths to post-quantum algorithms without claiming PQ transaction implementation.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
pq-migration-readiness
Review key custody architecture, attestation assumptions, access policies, rotation, audit logging and failure recovery.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
hsm-kms-enclave-architecture
Review reserve evidence design, liability completeness assumptions, timestamping, reconciliation and disclosed limitations; not a financial audit or attestation.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
proof-of-reserves-readiness
Prepare ACVP client/IUT adapters, test-vector provenance and Demo interaction evidence without claiming production CAVP validation.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
acvts-demo-proficiency
Prepare module boundary, roles, SSP management, self-tests, operational environment and evidence for an eligible external testing programme.
Readiness support is not accreditation or certification. An external grant and exact scope are required before such claims can be made.
Bewijs en opleveringen
fips140-module-readiness
Develop repeatable entropy acquisition, restart analysis, health-test, conditioning and deterministic random-bit-generator evidence.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
entropy-drbg-proficiency
Prepare authenticator, identity and protocol evidence against the exact applicable third-party scheme without presenting an internal review as certification.
Readiness support is not accreditation or certification. An external grant and exact scope are required before such claims can be made.
Bewijs en opleveringen
fido-identity-scheme-readiness
Review trusted-application code, attestation, secure-world boundaries and host/enclave interaction.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
tee-secure-enclave-review
Review embedded firmware, boot/update chains, memory safety, peripherals, debug interfaces and secure storage.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
firmware-security-review
Review memory safety, unsafe boundaries, x86_64/AArch64 behavior and low-level protocol implementation.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
native-low-level-review
Review hardware logic and security-relevant state machines where HDL is in controlled scope.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
hardware-description-review
Physical-device validation of secure elements, signing boundaries and hardware-wallet behavior under controlled laboratory methods.
Physical equipment, calibration, method validation and authorized personnel must be accepted before testing.
Bewijs en opleveringen
secure-element-wallet-lab
Controlled leakage assessment using trace capture and statistical analysis such as TVLA where method and equipment are accepted.
Physical equipment, calibration, method validation and authorized personnel must be accepted before testing.
Bewijs en opleveringen
side-channel-analysis
Controlled glitch/fault testing with interlocks, bounded attempts and safe shutdown under validated laboratory procedures.
Physical equipment, calibration, method validation and authorized personnel must be accepted before testing.
Bewijs en opleveringen
fault-injection
Map security targets, protection profiles, evaluation evidence and laboratory dependencies to separately administered schemes.
Readiness support is not accreditation or certification. An external grant and exact scope are required before such claims can be made.
Bewijs en opleveringen
common-criteria-readiness
Plan software, firmware, radio, secure-update, physical and lifecycle testing for a defined connected-product security scope.
Physical equipment, calibration, method validation and authorized personnel must be accepted before testing.
Bewijs en opleveringen
connected-product-security
Map model, data, agent, tool, user, retrieval and infrastructure trust boundaries for AI systems.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
ai-threat-model
Review prompt injection, tool/action authorization, unsafe autonomy, cross-agent trust and fail-safe behavior.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
prompt-agent-security
Review retrieval ingestion, provenance, malicious documents, ranking manipulation and data boundary failures.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
rag-poisoning-review
Review sensitive-data exposure through prompts, logs, training sets, embeddings, tool outputs and model responses.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
model-data-leakage
Review datasets, model artifacts, registries, pipelines, dependencies, signing/provenance and deployment permissions.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
ml-supply-chain
Review inference services, model serving, sandboxes, GPU/runtime boundaries and privileged integrations.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
ai-runtime-boundary
Execute controlled abuse and adversarial test cases against explicitly authorized AI system scope without unsafe autonomous actions.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
ai-adversarial-validation
Review repository access, SSO/MFA, audit logging, developer credentials, secret management and privileged development paths.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
development-opsec
Inventory authorized GitHub Apps, integrations, webhooks, deploy keys, bot access and repository selection; identify excessive or stale third-party access.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
github-access-review
Review cloud identities, roles, service accounts, least privilege, MFA, break-glass and auditability.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
cloud-iam-review
Review signer procedures, payload verification, backups, transaction tooling, segregation and bypass resistance.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
signer-opsec
Review security configuration and recovery risks for business email and scoped administrative/social accounts without collecting passwords.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
email-social-opsec
Review detection, escalation, war-room roles, containment, communications, key rotation, emergency governance and recovery procedures.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
incident-readiness
Review release approvals, environment separation, secrets, migration controls, rollback and production evidence.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
deployment-change-control
Evidence-led simulation of pre-agreed adversarial objectives without persistence, destructive payloads or testing outside approved scope.
A controlled and validated technical method or adapter is required before execution.
Bewijs en opleveringen
controlled-red-team
Review payment architecture and evidence gaps against the named contractual or industry programme; not a substitute for recognized PCI/EMVCo evaluation.
Readiness support is not accreditation or certification. An external grant and exact scope are required before such claims can be made.
Bewijs en opleveringen
payment-security-readiness
Maintain engagement context across architecture, code, infrastructure, governance, operations and release changes instead of restarting at each audit.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Doorlopend assurance-traject
Bewijs en opleveringen
continuous-security-program
Freeze exact candidate revisions, run authorized controls, retain evidence and fail closed when release prerequisites do not pass.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Doorlopend assurance-traject
Bewijs en opleveringen
security-gate-continuous
Track relevant dependency/security advisories and trigger scoped reassessment when material exposure changes.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Doorlopend assurance-traject
Bewijs en opleveringen
dependency-advisory-watch
Compare approved artifacts/configuration with deployed state and flag unauthorized or unexplained drift.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Doorlopend assurance-traject
Bewijs en opleveringen
deployment-drift-watch
Monitor approved protocol events, privileged changes and risk signals under an explicit monitoring scope.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Doorlopend assurance-traject
Bewijs en opleveringen
onchain-security-monitoring
Govern bounty scope, safe-harbor terms, intake, triage, duplicate handling, remediation and reward decisions without exposing secrets.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Doorlopend assurance-traject
Bewijs en opleveringen
bug-bounty-program
Orchestrate defined competition scope, researcher onboarding, submission judging, duplicate resolution and final findings.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
security-competition
Create a controlled incident timeline, owners, evidence, decisions, containment actions and communications with immutable post-incident records.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
incident-war-room
Convert incidents and nonconformities into root-cause analysis, corrective/preventive action, effectiveness checks and retained evidence.
The information and evidence workflow exists. Delivery requires assigned, appropriately competent personnel; it is not an automated test.
Bewijs en opleveringen
postmortem-capa
Build an evidence-linked transaction timeline and cross-chain hypothesis review without representing it as financial recovery or law-enforcement attribution.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
chain-transaction-forensics
Adjudicate scoped researcher submissions, duplicate groups, impact, appeals and fix verification under one retained finding register.
The relevant personnel competence must be evidenced and authorized before delivery.
Bewijs en opleveringen
audit-contest-judging
