We find what's already open.

Every surface you ship

• Web application testing

  Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

• Mobile application testing

  iOS and Android testing of the binary, on-device storage and transport, and of the backend API the app calls, replaying the app's own tokens to check whether one user can read another's data. On the device we check what the keychain or keystore stores, whether certificate pinning survives a bypass attempt and what deep links can trigger.

• Cloud configuration review

  An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

• Network & infrastructure testing

  Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

• AI & LLM application testing

  Adversarial testing of features built on large language models: chat assistants, retrieval-augmented search, agents with tool access, and generated output that reaches users or other systems. We test whether the model can be steered into leaking data, taking actions it should not, or passing untrusted output into the rest of your stack.

• Red team & purple team

  Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

• Social engineering assessment

  Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

• Incident response

  Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

• Threat modelling

  Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

• Secure development training

  Hands-on workshops for engineers, run against a deliberately vulnerable copy of a codebase like yours. Developers exploit each bug before they fix it, so they have seen the attack their fix has to stop, and review real pull requests for the same bugs.

Security audits of your website, databases and code

An audit checks configuration and code against a named standard, control by control, with evidence attached to every result. Fixing what an audit finds before a first penetration test means the test days go on the logic and access control that a configuration review cannot reach.

• Website security audit

  From the TLS handshake to the last tag on your checkout page: the site the public sees, reviewed setting by setting against the standards it should meet.

  3 to 6 working days

• Database security audit

  Where your most sensitive records live: who can reach them, who can read them, and whether anyone would notice if they did.

  3 to 7 working days

• Application security audit

  We read the code that decides who can do what, and the pipeline that ships it.

  5 to 15 working days, depending on codebase size

Findings that mattered

• Fintech

  Clearing an investor security review in under two weeks

  Investors wanted proof the payment flows were sound. Internal QA had never tested adversarially.

• Healthcare IoT

  Removing anonymous control access from clinical devices

  Hospital customers were reporting device API instability. The cause was not load.

• Logistics SaaS

  Hardening partner SSO before go-live

  The trust team was seeing partner logins with privileges nobody had granted.

A 45-minute pentest scoping call that ends with a fixed quote and a proposed start date.

Every engagement apart from incident response starts with this call. We walk your architecture with you, agree what matters most and what must stay off-limits, and recommend the kind of test that answers your question. The written scope follows by email, and there is no discovery invoice and no open-ended estimate.

• A recommended kind of test and depth, with the reasoning behind it
• A fixed quote for the agreed testing days
• A proposed start date and report date
• A clear line between what is in scope, what is out, and why
• A different recommendation, such as a threat model or an audit, if a penetration test is not what you need yet

Guides, and the news that changes what to test

• Guides for buyers

  Long-form guides for the people who commission and act on security work: preparing for a first test, reading the report, choosing between an audit and a penetration test, and the first day of a ransomware incident.

• Cyber news digest

  Breaches, exploited vulnerabilities, ransomware, supply chain attacks and new regulation, each item backed by at least two sources, with why it matters and what we check because of it.

What your sector faces, and what your regulator asks for

• Industries

  10 sector pages, from fintech and payments to defence and government suppliers, each with the attacks that sector draws and what we test because of them.

• Compliance frameworks

  16 frameworks, including PCI DSS 4.0.1, SOC 2, NIS2, DORA, HIPAA and Israel's Amendment 13, each with its testing and incident reporting rules and their sources.

What we know, published

22 protocol field guides, 111 tools grouped by task, learning tracks and checklists, free to every practitioner in the open library.