How we work, and what backs it.

Insurance

Invictus Cybersecurity LLC carries errors and omissions (professional liability) and general liability coverage. A certificate of insurance naming your organization is available on request during contracting — ask and we’ll have our carrier issue one. We don’t publish coverage limits here because the number that matters is the one on the certificate we hand you, not one on a web page.

Authorization — we don’t test without it

We do not perform any security testing without written authorization from someone empowered to grant it, against a scope defined in writing, within an agreed window.

Before any Application Security Test or external scan we agree, in writing: exactly which systems are in scope, which are explicitly out, who your emergency contact is, and how we stop if something breaks. If you don’t own the system, we need authorization from whoever does — a hosting provider, a SaaS vendor, a parent company. No exceptions, no verbal go-aheads, no “just take a quick look.”

This protects you as much as us. Testing without documented authorization isn’t a formality problem; it’s a legal one.

Confidentiality

We sign an NDA before scoping conversations as a matter of course — yours or ours, we don’t mind which. You do not need to ask.

We will not name you as a client, use your logo, or publish a case study about your engagement without your written permission. Where we reference prior work on this site without a client name, it is because we do not have that permission and are not going to imply we do.

What happens to your findings

• They’re yours. Reports, evidence, runbooks and documentation we produce belong to you. You keep them if you stop working with us.
• No lock-in. We are product-agnostic. Your program runs on tooling you own and control, documented so your team can run it without us.
• Handling. Engagement material is held only as long as the engagement and our records require, and destroyed on request at close.

What we are, and what we are not

For legal disclosure and proper services alignment:

• Our founder holds the CyberAB Registered Practitioner credential — verify the credential. Invictus is not currently a Registered Provider Organization (RPO); that registration is in progress.
• We are not a PCI QSA. We prepare you for assessment; we do not perform certified assessments or issue an Attestation of Compliance.
• We are not a SOC 2 auditor. We take you to the audit; a licensed CPA firm performs it.
• We are not a SOC and do not provide 24/7 monitoring or emergency incident response.

VM3 licensing

The VM3 Vulnerability Management Maturity Model is published under CC BY 4.0. You may use, adapt and share it, commercially or otherwise, with attribution to Aguero, E. (2026). VM³: A Vulnerability Management Maturity Model. You do not need our permission and you do not owe us anything. The VM3 name and the Invictus marks are not covered by that licence.

Website terms

Content on this site is provided for general information. It is not security, legal or compliance advice for your specific situation, and reading it does not create a client relationship. Advice happens in an engagement, under an agreement.

Engagement terms

Commercial terms — scope, fees, payment, liability, intellectual property, warranties and governing law — are set out in the signed agreement for your engagement. That agreement governs, not this page. We’ll walk you through it before you sign, and we’d rather you asked questions early than discovered surprises late.

Questions

Email contact@invictuscybersecurity.tech or call 726-263-0724. See also our Privacy Policy.