How we work inside your systems
You are giving us access to systems and data that matter. This page sets out how we test, how we handle what we see, how we use AI, and who you are working with.
How we test
Nothing is tested until it is authorised in writing
Every engagement starts with paperwork, not traffic. You know what we will touch, when, and how, before we touch it.
Methodology aligned with
Red teaming follows MITRE ATT&CK.
- Written authorisation and an agreed scope before any testing starts.
- Rules of engagement and testing windows agreed with you in advance.
- We prefer to test in staging. Where production is in scope, we work to read-only rules.
How we handle your data
Least access, shared only with the people you name
You decide who sees what we find. Your contract sets what happens to it when we finish.
- Access limited to what the agreed scope requires.
- Credentials and findings shared only with the contacts you name.
- Test data and credentials removed at the end of the engagement, as agreed in your contract.
How we use AI
Engineers lead. AI assists.
Senior engineers lead every engagement and AI tools assist them. The judgement, and the sign-off, stay with a person.
- A person approves every AI verdict and every fix.
- Our tools never hand your credentials to an AI model.
- If your policies restrict AI tooling, tell us at scoping and we'll plan the engagement around them.
Built into the products we run
- Pentests only hosts you prove you own, by DNS TXT record or file.
- Deterministic scanners run in containers with no network access, and your code is deleted after each scan.
- The AI never receives the repository clone credential.
- Staging recommended; production gets read-only rules.
- AI agents never receive passwords, keys, hostnames or a root shell.
- Every tool is set to allow, ask or deny, and every action is audited.
- Secrets are kept in a vault encrypted with AES-256-GCM.
Contracts
Confidentiality from the first conversation
Non-disclosure
We're happy to work under your NDA, or ours, from the first scoping call.
Data processing
For engagements that involve personal data, we put data processing terms in place with you.
Who you work with
A named company, with named people
Cyphlon has been based in Dubai since 2016. The team holds CISSP, CISM, OSCP, CCSP certifications, and an advisory board of practitioners from banking, healthcare and govtech advises on our work in regulated industries.
- Zeeshan Sultan CEO
- Navaid Ansari Head of Compliance
- Martin K Head of Finance and Operations
- Legal entity
- Cyphlon, sole proprietorship (DIFC, Dubai)
- Headquarters
- Dubai, United Arab Emirates
- Founded
- 2016
- Team certifications
- CISSP, CISM, OSCP, CCSP
- Advisory board
- Banking, healthcare, govtech
Report a vulnerability
Found an issue in our products or this site?
Email [email protected] with what you found and how to reproduce it. Use only the access you need to show the issue, and if you reach someone else's data, stop and tell us straight away.
- We acknowledge your report within 5 business days.
- We complete an initial triage within 10 business days.
- We send you a status update at least every 30 calendar days until the issue is closed.
- We coordinate disclosure 90 calendar days after your report by default, or later by agreement while a fix is in progress.
If you follow this policy in good faith, we consider your research authorised by us, and we will not start or support legal action or a complaint against you over it. We cannot authorise testing of third-party systems, and we cannot bind third parties or public authorities.
We do not run a paid bug bounty. We will credit you on request.
Book a call
Book a 30-minute call
Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.
Cyphlon
1:1 Consultation Call
30 min
Google Meet
An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.