Security testing and staff training for growing businesses, explained in plain English. The only thing we hide is your data.
Finding 01Critical
Former staff could still log in.
One account used the password . We were in on the first try.
Sample data. The bar hides a sample password on purpose.
Fix: disable leavers on their last day.
DisclosureConcept project. Redacted is an original fictional company created by CVO Atlas to show its branding work. It is not a real business.
Serious work. Plain words.
An imagined team of ethical hackers. Their clients are owners and IT managers who find security frightening and full of jargon, so the identity is exact where it counts, plain everywhere else, and dry enough to keep people reading.
$ redacted --brief
who owners and IT managers of growing businesses
fear security feels frightening and full of jargon
job test, explain, train
tone trustworthy · precise · a little dry
02 · Logo
The word stays. The bar continues.
The name is always complete and readable, followed by a redaction bar, as if the next words had been blacked out. A small highlighter cursor at the tip says a person is still at work. Give the bar a stem and it becomes the symbol.
Primary
Reversed
On Highlighter
The symbol, from app icon to sixteen pixels96483216
The bar slides back to reveal the descriptor, then the logo rests. The motion is optional; the static logo says everything.
03 · Colour & Type
Carbon, Paper, Highlighter.
Carbon and Paper do most of the work, and Highlighter marks what to act on. Signal Pink means one thing only: critical risk.
The Redacted palette
Name
Hex
Role
Carbon
#1B1C1E
Primary
Paper
#F1F1EC
Primary
Highlighter
#E4F04A
Primary · marks what to act on
Signal Pink
#FF4D79
Critical only
Graphite
#686B70
Support
Fog
#D9DAD4
Support
Hanken Grotesk · what we say
We found 3 ways in.
Here they are, in order, and how to close each one.
Black bars hide only what is genuinely sensitive, such as a password in a report. Here the bar hides a sample password.
Highlight
Disable leavers on day one.
Highlighter marks the fix: one action per section, never decoration.
Rank
Critical
Signal Pink, used for nothing else. Fix first. Sample: former staff can still log in remotely.
High
Highlighter. Fix soon. Sample: no two-step login on email.
Medium
Paper with a Carbon border. Plan it in. Sample: old software on the public website.
Low
Paper with a Graphite border. Tidy up when convenient. Sample: the server shows its version number.
Four labels rank every finding, always in this order. Nothing a reader needs is hidden or left to a hover.
04 · The report
The report is the product.
A penetration test report a business owner can read in ten minutes. Every finding is ranked by risk and by the time it takes to fix, and every finding ends with an action.
Sample report · Summary
Four things to fix. One of them this week.
Choose a finding to read it the way the client would. Example Logistics Ltd is fictional, and so is every finding: no real test took place.
Finding 01Critical
Former staff can still log in remotely.
What we did
We tried the remote-access login with accounts from a public staff list. Seven accounts belonging to people who left months ago still worked. One used the password , which appears in public breach lists. We were in on the first attempt.
Why it matters
Anyone with that list could reach the file server and the accounts system.
What to do
Disable accounts on a leaver’s last day. Turn on two-step login for every remote account.
Time to fix
About one hour
$ vpn-audit --stale 7 accounts inactive for more than 90 days 1 password found in breach list
Finding 02High
No two-step login on email.
What we did
We checked how staff sign in to email from outside the office. A password on its own is enough, on every mailbox we looked at.
Why it matters
Email is where every other password gets reset. One guessed password opens the lot.
What to do
Turn on two-step login for every mailbox. Start with finance and the directors.
Time to fix
Half a day
$ mail-audit --sign-in second step required: no
Finding 03Medium
Old software on the public website.
What we did
The website runs a plugin that is two years out of date. Its weaknesses are publicly documented.
Why it matters
Public weaknesses come with public instructions. Nobody needs to be clever.
What to do
Update the plugin and switch on automatic updates. Then check the site still works. It will.
Time to fix
Two hours
$ site-scan --plugins forms-plugin 2.1.4 · current 4.0.2
Finding 04Low
Server shows its version number.
What we did
The web server tells anyone who asks exactly which software version it runs.
Why it matters
On its own, very little. It saves an attacker some homework.
What to do
Hide the version number in the server settings. Then move on.
Everything else follows the same rules: plain sentences, one highlighted action, and Signal Pink only when something cannot wait. From the first letter to the alert nobody wants to receive.
Step 01 · First contact
A proposal with nothing hidden.
The letter sets out scope, timing and what the client receives, and ends on the brand’s promise: the only thing we redact is your data. The card says it in fewer words.
Front: the logo on Carbon. Back: a fictional name and contact details, and a dry reminder: never email us your password. We will never ask for it.
Step 02 · Online
A website that says it straight.
The business website uses the same case-file layout as this page: a sidebar index whose bars fill as you read, a sample finding up front, the services in plain words and one clear call to book a test. Even the 404 page keeps the joke going.
Step 03 · The walkthrough
Results, in a room, in plain English.
The test results are presented in person. The training slides keep to one number per slide, and the goal fits in one highlighted line.
Sample figures for a fictional client.
Step 04 · On stage
A conference kit with a straight face.
A speaker badge that reads at a distance, and stickers that make the point for you. Signal Pink stays off the merchandise.
Step 05 · If it cannot wait
The one place Signal Pink shouts.
An alert email has one job: get the right thing done today. Everything about it is built for that.
01Pink means critical. The header band is Signal Pink because this alert is critical. A routine email never uses it.
02The problem in one sentence. A staff password is being sold online. No jargon, no suspense.
03The secret stays secret. The account is named; the password is not repeated.
04Three steps, numbered. Reset, sign out everywhere, reply when done.
Sample alert for a fictional client. Redacted is not a real company, and nothing here is monitored.
Reports, slides, conference kits and alert emails show how far the identity can stretch. They are illustrations, not part of a standard package; what each branding package includes is listed on our Branding page.
06 · Guidelines
From the brand guidelines.
Twelve pages that keep the system exact: the bar, colour, type, the rules for redacting and highlighting, motion and voice.
96
48
