Partners

Keep your clients tested between audits

Your clients see you once or twice a year. Attackers test their apps every day, for free. A private bug bounty covers the months in between: you introduce the client, we run it, and the remediation work it creates comes back to you.

Who this is for

• Security consultancies and compliance auditors (ISO 27001, SOC 2, PCI DSS, DPDP).
• vCISO and fractional-CISO practices that own the client's security calendar.
• Managed security and SOC providers whose clients get monitoring but no offensive testing in between.

How it works

1. You introduce a client who ships often and wants cover between audits.
2. They sign off. A named scope, an NDA and a written testing authorisation. Nothing starts until all three exist.
3. Invited researchers test. Identity-verified before they are invited. Our team validates and scores every finding, with the steps to reproduce it.
4. You fix, we retest. The client pays only for findings they accept.

What your clients get

• Private, so safer. Only researchers we invite, testing only what the client approves, and nothing about their systems is published without their approval of the exact wording.
• Pay per real issue. The client sets the reward for each severity and pays only for findings they accept. No subscription, setup fee, retainer or minimum, and they can stop at any time.
• An easy first step. A free vulnerability-reporting page in the client's name, set up and run by us, so anyone who finds a flaw has a proper place to send it.

What you get

• A share of every engagement you introduce, agreed in writing before the first one starts.
• Real remediation work. Every confirmed finding arrives with steps to reproduce, and the fix stays with you.
• No competition. We don't fix, audit or certify. Your role with the client grows; it doesn't shrink.

What the platform enforces, not just promises

• Access to an engagement closes outside the agreed dates, and a finding against an asset recorded as out of scope is refused.
• Researchers are never given the client's company name, officers or contacts; the client never learns a researcher's legal identity.
• Every key action is recorded in a tamper-evident, hash-chained log.

The platform controls who may test and what they may submit. It does not sit in the client's network path. How it works and what we do and do not claim are public, and a labelled sample finding shows what a client receives.

When it is the wrong fit

• The client cannot fix what is found. Testing produces a queue; without remediation capacity it is a list of known, unfixed problems.
• They need a fixed scope on a fixed date for a compliance deadline. A scheduled penetration test is the right tool, and this runs alongside it, not instead of it.
• They need a CERT-In empanelled audit. This is not one and does not replace one.

Interested? Write to founder@exceptionsecurity.com with the kind of clients you serve, and we'll set up a 10-minute call. Vivek Kumar, Founder.