Question 1

How does the "no vulnerabilities, no pay" model actually work?

Accepted Answer

You pay only for confirmed vulnerabilities that meet or exceed the minimum severity you define for each program. Every finding is independently triaged and validated before it reaches you, so you never pay for noise, duplicates, or unverified claims. Costs are drawn against the budget you set up front, and you approve each finding before any payment is released.

Question 2

How do you vet the security researchers?

Accepted Answer

Every researcher on Reliant is an identity-verified Saudi professional who passes a multi-stage technical assessment and a background review before being admitted. We evaluate demonstrated track record, disclosure ethics, and hands-on skill — not self-reported résumés. Access to your program is granted only to researchers who have signed our binding confidentiality and conduct agreements.

Question 3

How is our data kept confidential?

Accepted Answer

Before testing begins, every participating researcher is bound by a legally enforceable NDA and strict rules of engagement that govern what they may access and how evidence is handled. Findings, evidence, and reports live inside your private program and are visible only to your authorized team and the assigned researcher. Reliant never resells, shares, or publishes your data, and all evidence can be purged on request once an engagement closes.

Question 4

Will testing disrupt our production systems?

Accepted Answer

Testing follows the rules of engagement you approve, which define exactly what is in scope, which techniques are permitted, and any actions that are off-limits. Researchers focus on demonstrating impact through controlled, evidence-based proof — not destructive or disruptive attacks. If you prefer, you can restrict testing to staging environments or specific windows, and you can pause any program instantly from your dashboard.

Question 5

How long does an engagement take?

Accepted Answer

Most programs go live within a day of you defining scope and budget, and qualified findings often begin arriving within the first week. Because testing is continuous rather than a fixed two-week audit, coverage deepens over time and you keep receiving findings for as long as your program is active. You control the pace by setting the program's duration and budget.

Question 6

What does a finding report include?

Accepted Answer

Every finding arrives as an auditable report with a stable RLT reference number, a CVSS score, clear reproduction steps, a business-impact assessment, concrete remediation guidance, and supporting evidence. Each report exports to a clean, professional PDF suitable for your engineers, auditors, and compliance teams. Nothing reaches you until it has been triaged and confirmed reproducible.

Question 7

Do we get a retest after we fix a vulnerability?

Accepted Answer

Yes. Every confirmed finding includes a free retest — once your team deploys a fix, you request a retest and the original researcher re-checks the exact issue. If the fix holds, the finding is marked resolved and verified; if it doesn't, it stays open at no extra cost until it's genuinely closed. You're paying for a fixed problem, not just a report.

Question 8

How does the prepaid Wallet work?

Accepted Answer

The Wallet lets you pre-fund your account so payouts settle instantly without arranging a bank transfer for every finding. You top it up by uploading a bank-transfer receipt, an admin verifies it, and the amount is credited to your balance — which you can then apply to any program. Your balance and every top-up and deduction are itemized in your dashboard for full transparency.

Question 9

What payment methods do you accept, and is VAT included?

Accepted Answer

You can pay per finding by verified bank transfer — uploading the receipt for admin approval — or draw instantly from your prepaid Wallet. All amounts are in Saudi Riyals and are quoted exclusive of VAT; 15% VAT is added on the invoice, and a compliant tax invoice is issued for every transaction. Your billing history and invoices are always available to download from your dashboard.

Question 10

How much control do we have over scope and rules of engagement?

Accepted Answer

Full control. You define exactly which assets are in scope, which are off-limits, what testing methods are permitted, and the minimum severity worth paying for — all before the program goes live. You can update scope, adjust budget, or pause the program at any time, and researchers are contractually bound to stay within those boundaries. Anything outside your defined scope is simply not eligible.

Question 11

What happens if no vulnerabilities are found?

Accepted Answer

Then you pay nothing for findings — that's the core of the model. A clean result is still a valuable outcome: it's independent evidence that your defined scope withstood testing by vetted researchers, which you can share with leadership, customers, or auditors. You keep any unused Wallet balance, and you can broaden scope or raise the reward to attract deeper testing whenever you're ready.

Question 12

How are findings triaged and duplicates handled?

Accepted Answer

Every submission is triaged and validated before it reaches you, so only reproducible, in-scope findings rated at the correct severity surface in your dashboard. If two researchers report the same underlying issue, only the first valid submission is eligible — duplicates are closed and never billed twice. This means the reports you review and pay for are already de-duplicated and confirmed.

Question 13

What if we disagree with a finding's severity or validity?

Accepted Answer

Each finding has a built-in comment thread where your team and the researcher can discuss scope, severity, and impact directly on the report. If you believe a CVSS rating or classification is off, you raise it there and Reliant's triage team helps adjudicate before anything is paid. You always approve a finding — and its final severity — before payment is released.