Skip to main content

Intake form for detailed assessment scoping

Vilkas Cybersecurity Scoping Questionnaire

Provide enough detail for a proposal, SOW, and pricing. Do not include identifiable asset lists, credentials, proprietary architecture, or other sensitive data—counts and high-level categories are enough. Your answers are saved automatically in your browser as a private draft until you submit.

Not saved yet
Definitions & reference

Click to expand and review key information that can help inform your scoping exercise.

Information disclosure levels

How much information the Client provides before testing begins.

Full Disclosure
The Client provides detailed information about in-scope environments, such as architecture, diagrams, and target lists. This option maximizes efficiency and depth of coverage by allowing Vilkas to focus testing on known assets while collaborating closely with the Client’s team.
Semi-Blind
The Client provides limited technical details (for example, IP ranges or application URLs) after initial discovery. This option balances realism and efficiency when the Client wants Vilkas to perform some discovery while still constraining scope and effort.
Blind
The Client provides little to no technical information before testing, and Vilkas relies primarily on publicly available information and testing‑derived data to discover and profile targets. This option best simulates the reconnaissance phase of a real-world external attacker.
Hybrid
Vilkas begins with limited or no information and transitions to a more cooperative, full‑disclosure posture once testing activity is identified by the Client’s monitoring or incident response teams. This option is appropriate when the Client wants both realistic attacker behavior and comprehensive coverage once detection occurs.

Evasiveness levels

How stealthy Vilkas will be during testing.

Non-Evasive
Testing is not intentionally concealed from the Client’s monitoring, IDS/IPS, or service providers. This option is typically used alongside full‑disclosure engagements to maximize coverage, speed, and visibility into findings.
Evasive
Vilkas uses techniques intended to avoid or delay detection by the Client’s monitoring and security controls. This option is appropriate when the Client wants to validate the effectiveness of existing detection and response capabilities, such as an MSSP, SOC, or IDS/IPS deployment.
Hybrid-Evasive
Vilkas begins with evasive techniques and shifts to non‑evasive operation once testing is detected or at a defined point in the engagement. This option provides a balance between assessing stealthy attack paths and ensuring comprehensive testing once coordination with the Client’s team is established.
Post-remediation testing: Post-remediation testing to confirm the effectiveness of the Client’s corrective actions and updated security controls is included in all test scopes.

Billing address

Primary point of contact

Business email required.

Hover the “?” next to Attestation Letter for a short definition.

Select all that apply, and scoping questions for each selected service will appear below. You can collapse sections when finished. If you do not have the required information readily available for each assessment type, fill out as much as you can, and we will follow up with any questions/clarifications.

Additional details

Optional catch-all for anything that helps us price and scope accurately. Do not include credentials, exact IPs/hostnames, proprietary diagrams, or other sensitive/identifiable details.

Submit

We will generate a PDF summary and send it to [email protected] for a Vilkas consultant to review. You may download a copy and optionally email one to yourself.

Protected by Cloudflare Turnstile. Privacy & Terms.