Explicit authorization
The right to act is documented, limited and never inferred from technical access.
The Hexterm approach
Ethics are not optional.
They set the boundaries.
A rigorous method where authorization, traceability, confidentiality and responsibility precede every action.
Discover the methodAuthorizationTraceabilityConfidentialityResponsibility
- 01
Scoping and authorization
Define objectives, scope, responsibilities, exclusions and stop conditions.
- 02
Defensive assessment
Understand assets, controls, processes, signals and blind spots.
- 03
Offensive validation
Test only approved hypotheses using proportionate methods.
- 04
Remediation
Prioritize corrections by risk, effort and dependencies.
- 05
Continuous improvement
Verify changes and reassess when the context evolves.
Operating principles
Rigour is a form of respect.
Respect for people, systems, data and agreed boundaries.
Traceability
Actions, decisions and evidence remain attributable and verifiable.
Confidentiality
Information is minimized, protected and retained according to need.
Responsibility
Automation does not erase the author, the approver or the impact.
Improvement cycle
Defend. Test. Improve.
Blue Team and Red Team are not silos. Their findings contribute to traceable improvement.
ObserveSignals, assets and operational context.
UnderstandHypotheses, impact and blind spots.
RespondProportionate actions and documented outcomes.
AuthorizeMandate, scope and rules of engagement.
ValidateTargeted, controlled and attributable tests.
StrengthenActionable findings and verified remediation.
Nuanced findings
Facts, confidence levels, hypotheses and limitations clearly separated.
Justified priorities
Risk, effort, dependencies and operational context considered together.
Realistic remediation
Proportionate, understandable and verifiable recommendations.
Transparent follow-up
Action status and residual risk communicated without false absolutes.
Why this approach
Control inspires trust.
Less ambiguity
Permissions, responsibilities and stop conditions remain explicit.
More context
Decisions rely on understandable, attributable evidence.
Verifiable progress
Every correction can be reviewed and adjusted as risk changes.