Authorization intake
We identify the system owner, authorization source, business objective and evidence constraints. Unclear ownership stops the work.
Methodology
A controlled path from question to evidence.
Automation expands coverage. Deterministic controls preserve authority. Independent verification decides what can be claimed.
Scope compilation
Domains, repositories, addresses, exclusions, techniques, rate and testing windows become deterministic policy—not prose a model can reinterpret.
Controlled research
AI assists with planning, retrieval and analysis. Typed tools and isolated browser actions run only after policy, risk, approval and budget checks.
Independent verification
A separate verification pass tests the claim against the evidence. Unsupported candidates are rejected or returned for more evidence.
Human-reviewed reporting
The report cites reproducible artifacts, states uncertainty and recommends remediation. Export requires approval; submission is never automatic.
“A code pattern is a hypothesis. Only demonstrated, reproducible impact inside authorization can become a finding.”
Viridis research principle