Before continuing to the main topic, as soon as I read “Decisions are taken by the (non-technical) directors” I would suggest you look somewhere for another job

Before continuing to the main topic, as soon as I read “Decisions are taken by the (non-technical) directors” I would suggest you look somewhere for another job unless that person has outstanding leadership experience (clearly not), this dynamics (non-tech is dictating on tech) will be the most infuriating and frustrating experience you will have to put up with, I have been in that position before, in fact, I have seen small companies turning into chaos after replacing the tech-manager with non-tech one (usually sales or business), as those usually lack the technical background, and to stay ahead of the technical folks, they pull all political shenanigans and psychological manipulations. Now to your topic, you are to be blamed: - Never ever claim something is done when it wasn’t, especially in cybersecurity, this will always fire back and I have seen it firsthand, you will be liable when the first breach happens since you gave the green light from a technical perspective. - You are supposed to protest the company's position yet they threw you in front of the bus at the first corner (when the client asked for evidence)? What do you think it will be when legalities hit later? - You are being used, and sorry to burst your bubble, bullied too, it is clearly what type of work environment when you get a WRITTEN email with a slur, not even verbal. - From my experience too, going to higher management will not do anything (like a CEO) in small companies, as usually they are all the same, in fact, the CEO will be using the director as a shield to take the shit later, and the director is using you as a shield, you get the idea. The course of action if I were you: - Meet with the client and be transparent, say you never said that, no pentesting is ever done, and be clear the director said it. I would even go the extra mile and record that call, just ask for consent first. - Give your resignation right after the meeting, and be clear about the reasons why, you will thank yourself later. - Edit: I would also make a CYA (cover your arse) folder, I usually do that in similar situations, document everything. You can of course take legal advice, but since nothing is actually done (assumed in the negotiation phase) and unless there’s hard evidence (like those emails you mentioned are clearly asking to falsify it), I don’t think it will be worth it, but I’m not a lawyer.