Consulting
Penetration testing
Security assessments led by the researcher behind the advisories on this site. Each engagement goes deep on the systems you most need to trust, and every finding is tested and confirmed by hand before it reaches your report.
What you get
A focused assessment scoped to the systems you most need to trust, rather than a broad scan across everything. You get a written report that a working engineer can act on: clear steps to reproduce each issue, an honest account of its impact, and guidance on fixing it. We confirm every issue against your own environment first, so you are not left chasing false positives. Where it helps, we build a working proof of concept your team can run and assess for themselves.
How we use automation
We use automation, including tools that use AI, for the parts of an assessment that reward covering a lot of ground quickly. At the moment that means Claude Opus 4.8 from Anthropic, run through Claude Code. We do not use it to decide what counts as a finding. A researcher reviews what the tools produce, does the real testing, and confirms each result.
- 01
Scanning and enumeration
We map the attack surface and run broad scanning, including tools that use AI, to surface anything worth a closer look. This is where breadth and speed matter.
- 02
Review and prioritization
A researcher reads through the results, clears out the false positives, and decides where the time is best spent. A scanner result is a lead, not a finding.
- 03
Testing and verification
The actual testing is done by hand. We reproduce each issue against your environment, chain problems together where it is warranted, and work out the real impact before writing anything down.
- 04
Reporting and retesting
You get a written report with severity, steps to reproduce, and guidance on fixing each issue. Where it helps, we build a working proof of concept your team can run and assess for themselves. Once your fixes are in place, we retest to confirm they hold.
Where we focus
- Web applications and APIs, including authentication, access control, and the boundaries between tenants.
- Cloud systems, including identity and permissions, network exposure, and the way services are configured and connected.
- Browser, client, and platform code reachable from untrusted input, which is our standing research area.
- Developer tooling and AI agent infrastructure, where software now runs untrusted input and the trust boundaries are still being worked out.
How we work
- Scope agreed in writing. We agree the targets, rules of engagement, and testing windows in writing, and we do not test anything until it is authorized.
- Findings stay with you. We treat client findings the way we treat our research. They are yours. We do not sell them or publish them.
- Limited availability. We take on only as many engagements as one researcher can give proper attention, so it is worth reaching out early.
Get in touch
Tell us the scope, your timeline, and what you need. Please leave secrets and exploit details out of a first message.