HackingByte

04/06/2026

Five things HackingByte does not do.

1. We do not sell day rates.
Day rates reward slow work. Engagement-band pricing is tied to scope rewards for finished work. You know the number before we start.

2. We do not resell tools or take vendor commissions.
The recommendation in your report is the recommendation we would make if no vendor existed. No referral fees, no partner tiers, no quotas.

3. We do not run free pilots.
The scoping call is free. Everything past that is engaged. A free pilot is a test only one side is paying for, and the side not paying decides what counts as a pass.

4. We do not claim certifications or accreditations we do not hold.
What appears on the website is what we hold. Nothing is implied, nothing is "in progress" as a credential.

5. We do not publish client logos without written consent.
Confidentiality is a default, not an upsell. Logos appear on our site only where the client has signed off in writing.

If any of the five is a problem, we are probably not the right firm.
If none of them are, the scoping call is available at https://hackingbyte.com/contact

Proof, not promises.

Book a scoping call with HackingByte — a senior conversation about your real exposure and what to test first. One working-day response from the founder.

02/06/2026

Most security firms publish a service list. Few publish a methodology.

Here is the way our engagements actually run:

1. Scoping — defined assets, objectives, threat model, rules of
engagement, deliverables. Output: a Statement of Work neither side has
to interpret.

2. Kickoff — confirmed contacts, escalation paths, working schedule,
secure communications, access. One call, 60 minutes.

3. Ex*****on — testing, assessment, or advisory work. Critical findings
escalate within four working hours of discovery, not at report delivery.

4. Reporting — three artefacts from the same engagement: a technical
report for engineers, a board brief for executives, an action plan
with named owners and due dates.

5. Debrief — two sessions: technical (with the engineering team) and
executive (with leadership). 90 minutes each. Questions from both
audiences land in the action plan.

6. Closure and optional retest — the action plan moves to the named
owners; an optional retest closes Critical and High findings with
audit-defensible evidence.

Standards we cite — and the corresponding standard appears in the SOW
and in the report:

- External / Internal PT: PTES, MITRE ATT&CK Enterprise.
- Web / API: OWASP WSTG, OWASP API Top 10.
- Mobile: OWASP MASVS, OWASP MSTG.
- Cloud: MITRE ATT&CK Cloud Matrix, CIS Benchmarks.
- Red Team / Adversary Simulation: MITRE ATT&CK + sector threat-actor
profiles; TIBER-EU principles where applicable.
- TLPT: TIBER-EU, CBEST, DORA TLPT-RTS, NIS 2.
- ISO 27001, SOC 2, NIS 2, DORA, GDPR, FAIR (where quantification is
requested) — for GRC engagements.

If your shortlist of security firms does not include a methodology page,
that is information about the shortlist.

Full standards list and engagement walkthrough on the methodology page — link in the comments.

01/06/2026

HackingByte is live at hackingbyte.com.

We are a senior-led cybersecurity firm based in Casablanca, working with
clients across Morocco, Europe, the UK, and the wider region.

What we do: pe*******on testing, red teaming, GRC advisory, and security
assessments. Every engagement produces three artefacts — a technical
report for engineers, an executive risk brief for the board, and an
action plan with named owners.

Methodology in writing — the standards we use are named in the SOW and
in the report (PTES, OWASP, MITRE ATT&CK, OWASP MASVS, CIS Benchmarks,
TIBER-EU principles where applicable, ISO 27001, SOC 2, NIS 2, DORA).

Read the methodology: https://hackingbyte.com/methodology/
Contact: [email protected]

How HackingByte tests and reports — a senior-led engagement lifecycle, cited standards, peer review, and the Engagement Brief that turns findings into decisions.