Methodology

Accessibility audits

1. Scoping by page templates and user flows, so testing is representative rather than exhaustive-but-shallow.
2. Automated scan (axe-core) to establish a baseline and catch machine-detectable issues quickly.
3. Manual review against every WCAG 2.2 Level A and AA success criterion - automated tools alone catch only a portion of real issues.
4. Assistive-technology testing: NVDA with Chrome, JAWS with Edge, VoiceOver on iOS and macOS, and TalkBack on Android.
5. Severity rating for every finding, so your team can prioritize fixes by real user impact.
6. A report mapped to WCAG 2.2, plus the relevant regulatory standard (ADA/Section 508, EN 301 549/EAA, IS 17802/GIGW, as applicable).
7. A verification retest once remediation is complete.

Security testing

1. Scoping and rules of engagement, agreed in writing before any testing begins.
2. Threat modelling against your actual architecture, not a generic checklist.
3. Testing against OWASP WSTG, OWASP ASVS, the OWASP Top 10 for LLM Applications (where AI/LLM components are in scope) and MITRE ATT&CK.
4. Manual exploitation with proof-of-concept evidence - we don't report a finding we can't demonstrate.
5. CVSS scoring for every finding, so severity is consistent and defensible.
6. A report with reproduction steps and remediation guidance mapped to your codebase or infrastructure.
7. A verification retest once remediation is complete.

See Credentials for the certifications held by the practice, and Editorial Policy for how our articles and guides are researched and reviewed.