Security runs on trust. Before we test anything, you have to be willing to show us where you're weakest. Your team has to be comfortable telling us what's actually going on – the system nobody has patched, the thing that was meant to be temporary three years ago.
So that's what we built the company around. Honest conversations before anything starts, clear scope agreed up front, and no surprises about what we're doing or what we find.
Alongside all of that, we spent years making one argument in rooms where it wasn't always welcome: hackers who report a vulnerability in good faith deserve protection, not suspicion.
That argument was won. The Dutch guidelines on responsible reporting, and later on Coordinated Vulnerability Disclosure, made clear that someone who reports properly, stays within reasonable limits and doesn't run to the press shouldn't be treated as a criminal. We helped shape that work – our CTO's photo is actually printed inside the guideline.
<read our blog about it> (link to CVD creation blog)
Why does that matter to you? Because it's what makes it safe for a resident, a supplier or a complete stranger to tell you something is wrong with your systems. And safe for you to receive it.
When you hear the word "hacker", what comes to mind first? A dimly lit basement and a hoodie? Or that friend from school who could fix absolutely anything?
The industry has spent years inventing softer labels – white hat hacker, ethical hacker, security researcher. Every one of them is a quiet apology for the word underneath it.
We're done with that. We use the original word, on purpose.
Our network doesn't fit anyone's stereotype. It doesn't matter how you look, where you're from or what you studied. What matters is a curious mind that notices the thing that shouldn't be there – and the choice, made long before anyone met us, to use that for something good.
And to be clear about how this works in practice: the hackers on your programme are selected individually, for your assignment, based on their skills and track record and how well they fit your environment. They work under an agreed scope and rules of engagement everyone has signed. We don't just open the door and see who wanders in.