Book a call

EngagementFrom brief to report

Tell us what is changing. We help define the Countermind.

Start with the system, the decision in front of you and your timeline. We agree technical fit and a written scope before anything is tested.

Book a call What to share

A clear beginning. An agreed scope.

  1. Step 1 Your brief System, priorities, timing
  2. Step 2 Scoping call Fit, access and boundaries
  3. Step 4 Agreement Before any testing

A brief leads to a scoping call and written terms. Contacting us does not authorise testing.

A conversation first. An agreement before access.

The first call establishes fit. Access and testing follow the written engagement, never the first message.

  1. Steps 1 and 2First call

    Discuss the need

    Clarify the systems, the decision, the constraints and technical fit.

  2. Steps 3 and 4Written engagement

    Confirm the scope

    Agree authorisation, access, actions, timing, deliverables and terms.

  3. Step 5 onwardControlled start

    Coordinate kickoff

    Set contacts, permitted environments and escalation arrangements.

  1. Step 1 Brief received You
  2. Step 2 Scoping call You + Zaaf
  3. Step 3 Proposal sent Zaaf
  4. Step 4 Scope signed You
  5. Step 5 Kickoff You + Zaaf
  6. Step 6 · within 48 hours Investigation and verification AI + review desk
  7. Step 7 Report delivered Zaaf
  8. After delivery Retest, where agreed Zaaf

An illustrative sequence for a scoped Web & API Countermind. AI investigation is instant; human verification of every finding takes up to 48 hours.

Booking a call or sending an email does not start a Countermind or authorise automated testing.

The right shape of work for the decision ahead.

Proposed shapes, subject to technical fit and availability. Pricing is agreed after scoping.

TimingSet during scoping

Scoped Countermind

A defined question

Focus on a product or a trust boundary.

Start here when
You need a bounded look at selected systems and workflows.
Start with
The application or integration you want examined, and why it matters now.
We define
Assets, roles, permitted actions, reporting needs and exclusions.
What to expect
A proposal based on technical fit and the agreed depth of the work.
  1. Assets
  2. Scope
  3. Report

TimingPlanned around your release

Release Countermind

A meaningful change

Bring the change into scope before it ships.

Start here when
You are preparing a sensitive workflow, integration or infrastructure change.
Start with
What changed, the release dependencies and the decision date.
We define
Relevant components, environments and the access available before that date.
What to expect
Timing confirmed during scoping, never an automatic promise to meet every deadline.
  1. Change
  2. Review
  3. Release

TimingAgreed cadence

Recurring review

Follow-through by agreement

Revisit what changes. Check selected fixes.

Start here when
You want reviews around changes and remediation, on an agreed cadence.
Start with
Your release cadence and the kinds of change that warrant review.
We define
Frequency, selection of work, reporting and retest terms.
What to expect
An explicitly scoped engagement, not implied continuous monitoring or unlimited coverage.
  1. Review
  2. Fix
  3. Retest
Step1On the timeline

A short brief. A more useful first call.

What to put in a first message, and what to keep out of it.

Include Keep out
01System and surface Web & API, Cloud or Web3, with a short product and architecture description. Credentials, private keys or unrestricted access links.
02Why now The release, integration, customer request or concern driving the work. Assuming that contacting us authorises testing.
03Proposed scope Approximate assets, relevant roles and the test environment available. Third-party targets or assets you cannot authorise.
04Timeline Your target date and any external dependencies. Promising a date to your customer before we confirm availability.
05Requirements Your technical contact and any reporting or contractual needs. Sensitive findings or customer data in the first message.
Step3On the timeline

A proposal you can evaluate before the work begins.

The scope should make sense to the person authorising the work and to the engineers supporting it.

The proposal covers

  1. 01

    Scope and exclusions

    Named systems and workflows, relevant environments and known limits.

  2. 02

    Access and responsibilities

    Required accounts, your inputs and permitted operations.

  3. 03

    Delivery and timing

    Proposed deliverables and agreed scheduling.

  4. 04

    Commercial and follow-up terms

    Price, retesting and any additional requirements.

What shapes the price

  • 01ScopeHow many applications, APIs, contracts or resources, and how many workflows.
  • 02ComplexityRoles, tenants, integrations and the depth of business logic.
  • 03AccessTest accounts, environments and how much setup the work needs.
  • 04ReportingFormat, audience and any customer or contractual requirements.
  • 05Follow-upRetests, recurring reviews and their cadence.

We quote after the scoping call. There is no price list.

Send your scope summary

Straight answers

How much does a Countermind cost?

Price depends on scope, complexity, access, reporting and follow-up. We quote after the scoping call.

Can we start with a small scope?

Yes, subject to technical fit. Its conclusions apply only to the agreed scope.

Do you sign an NDA?

Yes. Share your NDA or data requirements before sending sensitive material; we send ours or review yours.

Does booking a call start testing?

No. A call is a conversation. Testing needs a written engagement and authorisation.

Is this a pentest?

Countermind covers what buyers expect from a pentest, with every finding reproduced and signed by a researcher.

Do you test physical devices?

Not today. Physical-device work is in development and is not offered as a service.

Bring your scope. Let's plan the Countermind.

Thirty minutes with a Zaaf researcher. You bring one scope; we show you what a Countermind would look at first.

Book a call hello@zaaf.ai
Next step
30-minute call
With
A Zaaf researcher
You bring
One scope
Runs before you agree
Nothing
Book a call