You describe what you are protecting. We read it and come back to you, NDA first.
We state exactly what would be tested, in what order, and what proof would look like for each item.
Work runs inside the agreed boundary, with the pipeline visible to you step by step.
Reproducible proof per finding, the remediation that closes it, and a re-test on request.