Security Disclosure Policy

As a cyber security training and consultancy business, we take the security of our own website seriously and welcome reports from security researchers who find a genuine vulnerability.

How to report

Please email details of the issue, including the steps to reproduce it, to info@itopsec.com. Please do not publicly disclose a vulnerability until we have had a reasonable opportunity to investigate and address it.

What we ask researchers not to do

• Do not access, modify or delete data that is not your own.
• Do not run automated scanning tools that could degrade the service for other users.
• Do not attempt to access non-public areas of our systems or those of our hosting provider.
• Do not test any course booking or payment process using real payment details — this website does not process online payments.

Reports made in good faith, within these guidelines, will not result in legal action from us. We aim to acknowledge reports promptly and will keep you updated on our progress, but we do not currently operate a paid bug bounty programme.

This policy was last updated on 2 November 2026.