Code of Ethics and Professional Conduct

The principles that bind AUREON INTELLIGENCE L.L.C-FZ, its employees, contractors and partners in every engagement.

Last updated: 2 October 2026AUREON INTELLIGENCE L.L.C-FZ

Preamble

Aureon Intelligence investigates intrusions, tests defences, gathers intelligence and advises organisations on some of their most sensitive matters. Clients, insurers, courts and regulators rely on our work precisely because it is independent, lawful and accurate. This Code sets out the standards that every person working for or with Aureon must uphold. It applies to directors, employees, contractors, subcontractors and partners ("Aureon personnel") in all jurisdictions where we operate.

Where local law imposes a higher standard, local law prevails. Where this Code imposes a higher standard than local law, this Code prevails.

1. Integrity and honesty

  • We tell clients the truth, including when the truth is unwelcome: when an incident is worse than hoped, when data recovery is unrealistic, when a control they bought does not work.
  • We never alter, omit or overstate findings to favour any party, including our own commercial interests, an insurer, a client's management or counsel.
  • We do not accept gifts, hospitality or benefits that could reasonably be seen to influence our judgement. Modest, transparent hospitality consistent with normal business practice is acceptable; cash or cash equivalents never are.
  • We compete fairly. We do not disparage competitors with false statements, misuse their confidential information or obtain business through improper means.

2. Compliance with the law

  • Aureon personnel comply with all applicable laws, including the laws of the United Arab Emirates, the European Union and its Member States, the United Kingdom and every jurisdiction in which we deliver services.
  • We comply with anti-bribery and anti-corruption laws, including the UAE Penal Code, the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act where applicable. Facilitation payments are prohibited.
  • We comply with economic sanctions and export control laws of the UAE, the EU, the UK, the United Nations and the United States. Before any ransomware payment is contemplated in an engagement we support, the threat actor is screened against applicable sanctions lists and the decision is documented. Aureon does not make or facilitate payments to sanctioned persons.
  • We comply with anti-money-laundering obligations and report suspicious activity where required by law.
  • We respect intellectual property and the licensing terms of the tools we use.

3. Lawful authority for security testing and investigations

  • Offensive security activities are carried out only with explicit, written authorisation from a person entitled to grant it, within agreed scope, rules of engagement and timeframes. Authorisation is verified before any activity begins.
  • We never access, test or interfere with systems, data or networks that are outside the agreed scope, even if we discover a way to do so. Unexpected findings are reported, not exploited.
  • Investigations and intelligence collection are conducted using lawful methods. We do not purchase stolen data for the purpose of enriching ourselves or others, we do not deceive individuals into revealing information outside authorised social engineering exercises, and we do not engage in unlawful surveillance.
  • We do not "hack back". Aureon does not conduct offensive operations against threat actors' infrastructure outside a lawful mandate.

4. Confidentiality

  • Everything we learn about a client, its personnel, its customers and its incidents is confidential. We disclose it only as required to deliver the engagement, as authorised by the client or as required by law.
  • We respect legal privilege and work under counsel's direction where instructed, keeping privileged and non-privileged communications appropriately separated.
  • Client information is handled on a need-to-know basis within Aureon. Personnel do not access engagement data to which they are not assigned.
  • Confidentiality survives the end of an engagement and the end of a person's relationship with Aureon.
  • We never use knowledge gained in one engagement to the disadvantage of that client, and we do not disclose one client's information to another.

5. Evidence and investigative standards

  • Evidence is acquired, handled, stored and analysed using documented, reproducible methods aligned with ISO/IEC 27037 and ISO/IEC 27042 and the principles applied by courts in the jurisdictions where we operate.
  • Chain of custody is maintained for every item of evidence from acquisition to return or destruction.
  • Findings are distinguished from assumptions. Confidence levels are stated. Alternative explanations are considered and documented.
  • Reports are written so that they can be examined by opposing experts. We do not write to a predetermined conclusion.
  • When we act as expert witnesses, our duty is to the court and to the truth, above the interests of the party instructing us.

6. Independence and conflicts of interest

  • Aureon does not resell security products and does not accept referral fees or commissions from vendors. Our recommendations are based on evidence and on the client's interest.
  • Personnel must disclose any personal, financial or family interest that could conflict with their duties, including relationships with clients, suppliers, competitors or parties involved in an investigation.
  • Where a conflict exists between clients, for example in a dispute, we decline or withdraw from the engagement unless all affected parties give informed consent and the conflict can be managed through separation of teams and information.
  • Personnel do not use client information or Aureon's position for personal gain, including trading in securities on the basis of non-public information learned during an engagement.

7. Data protection and privacy

  • We process personal data in accordance with the UAE Personal Data Protection Law, the GDPR and other applicable laws, and in accordance with our Privacy Policy.
  • We apply data minimisation. We collect and retain only what the engagement requires and we return or securely destroy data at the end of the engagement in line with the agreement.
  • Access to personal data encountered during investigations is limited, logged and never used for purposes outside the engagement.
  • Individuals whose exposed credentials or data we discover in threat intelligence activities are treated as potential victims. Their data is protected, not exploited.

8. Responsible handling of vulnerabilities and threat intelligence

  • Vulnerabilities we discover in third-party products are reported to the vendor through coordinated disclosure. We do not sell vulnerabilities or exploit code and we do not publish details before a reasonable remediation period has elapsed.
  • Threat intelligence is shared with clients, partners and authorities only where lawful and where sharing serves defence. Indicators are shared without exposing victims' identities unless necessary and authorised.
  • Malware and offensive tooling are stored and handled in controlled environments and are never released outside authorised engagements.

9. Respect for people

  • We treat colleagues, clients and third parties with dignity and respect. Harassment, discrimination, bullying and retaliation are prohibited.
  • We recruit, develop and promote on merit. We value diversity of background and experience.
  • We take care of the wellbeing of our people, including during the sustained pressure of major incidents. No one is expected to compromise safety, health or ethics to meet a deadline.
  • Authorised social engineering exercises are designed to test controls, not to humiliate individuals. Results are reported in a way that protects the people involved.

10. Quality and competence

  • Personnel undertake only work for which they are competent, and they seek support when a matter exceeds their expertise.
  • We maintain our skills through continuous learning, certification and participation in the professional community.
  • Our methodologies are documented, reviewed and improved after every significant engagement. Mistakes are acknowledged, corrected and learned from.

11. Accountability and reporting concerns

  • Every engagement has a named responsible lead who is accountable for its conduct and quality.
  • Personnel must promptly report any suspected breach of this Code, of the law or of a client agreement to management or, where that is not appropriate, directly to the Company's directors.
  • Reports may be made confidentially. Aureon prohibits retaliation against anyone who raises a concern in good faith.
  • Breaches of this Code result in disciplinary action, which may include termination of employment or contract and referral to authorities where required.

12. Application to partners and subcontractors

Partners and subcontractors engaged by Aureon must agree to standards consistent with this Code before they take part in any engagement. Aureon remains responsible to its clients for the conduct of the people it engages.

13. Governance

This Code is approved by the directors of AUREON INTELLIGENCE L.L.C-FZ and reviewed at least annually. Questions about its interpretation may be sent to info@aureonintelgroup.com with the subject line "Code of Ethics".