Skip to content
Lead Magnets

Working artefacts.
Free. Email only.

Four operator-built artefacts that immediately help an engineering or security team. No NDA. No drip campaign. Email-only — we send the document, then we leave you alone unless you reply.

3
Artefacts
$0
Cost · no NDA
1
Email, then silence
Why these exist

Real working documents we use internally.

These four documents started life as internal templates we kept rewriting for every client engagement. We cleaned them up, removed customer-specific content, and published them so you can use them whether or not we ever speak.

Each one is markdown — readable in any editor, copy-pasteable into your wiki, easy to extend. Sources are cited where they matter (MeitY for DPDP, AICPA for SOC 2, AWS for the cloud policy). Nothing is fabricated.

Email gating is the only friction. You give us your email, we send the document, and we file you under "sent the SOC 2 checklist" in our heads. No newsletter unless you ask.

Available Lead Magnets

Four artefacts, one short form away.

VAPT Scoping Checklist

Markdown

50+ pre-engagement questions, organised by surface — engagement, inventory, out-of-scope, auth, application, third-party, cloud, AD, mobile, test windows, deliverable, legal. Fill it async and the scoping call collapses to 20 minutes.

Best for

First-time pentest buyers. Repeat buyers who want a tighter scoping conversation.

Get the VAPT Scoping Checklist→

SOC 2 Readiness Checklist

Markdown

Pragmatic Type II prep checklist — CC6, CC7, CC8 broken down with evidence requirements, the 90-day pre-audit timeline, and the six common Type II audit failure patterns we see at growth-stage SaaS.

Best for

Series A/B SaaS preparing for first SOC 2 Type II. Security engineers gathering evidence before the auditor walkthrough.

Get the SOC 2 Readiness Checklist→

AWS Pentest Scope Template

Markdown

What to ask in AWS pentest scoping — accounts, regions, services in scope, AWS-policy-derived rules, IMDSv2 baseline, logging baseline, internal authorisation memo. Aligned to the published AWS pentest policy.

Best for

Platform engineers running AWS-only or AWS-primary environments. CTOs who do not want to forget the internal authorisation step.

Get the AWS Pentest Scope Template→
After You Request

We send the document. That is it.

Each request lands in the inbox of the operator who owns the artefact. The artefact ships in your inbox, usually the same business day. There is no automated drip after that — no "day-3 nudge", no "day-7 case study", no calendar invite for a discovery call you did not ask for.

If you want to talk, the contact form routes the same way and a 30-minute scoping call is free. If you do not, the artefact is yours and we move on.

Some of these reference resources we ship under NDA — particularly the redacted sample VAPT report on /resources. The four documents on this page are not under NDA. Use them, fork them, paste them into your wiki.

Need something specific?

The four documents listed are the most-requested versions. Our operators have written sector-specific scoping aids, regulator-facing templates, and evidence packs beyond these four. If you need something specific, ask.

Ask an OperatorSee Other Resources