Infrastructure, application, adversary, and IoT/OT testing.
Networks, cloud, identity, applications, AI systems, connected devices, OT, and approved adversary scenarios.
Reproducible evidence, risk context, prioritised fixes, an operator read-out, and retesting.
Most engagements run for two to four weeks. OT work typically needs three to six weeks of lead time.
Network, cloud, identity.
External and internal networks, AD and Entra ID, cloud perimeter, wireless. We map the routes attackers would take and prove them.
More → ApplicationWeb, API, mobile, LLM.
Code-assisted testing with reproducible findings. Auth and tenancy, business logic, RAG and agent boundaries.
More → Adversary simulationRed, purple, social.
Objective-based campaigns with approved scope and Rules of Engagement. Phishing and ransomware simulation when useful.
More → IoT · Embedded · OTDevice, firmware, operations.
Firmware, connected ecosystems, wireless surfaces, update paths, and production-safe OT validation.
More →What reproducible evidence looks like.
A public example from our own research. Client reports use the same sequence: observation, evidence, impact, and a specific fix.
Read the technical analysis →- Observation
- Case-insensitive backreference matching in WebKit's YARR JIT could index beyond a 256-entry canonicalisation table.
- Evidence
- A captured character above U+00FF drove an out-of-bounds read and a match/no-match oracle.
- Impact
- Crafted web content could disclose WebKit process memory.
- Fix
- The patch adds the missing bounds check before the table lookup. Apple shipped the fix in the 26.5.2 updates.
A scoping call to understand what you're protecting and what you're worried about. Testing. A written report with reproducible evidence and prioritised fixes.
Most engagements take two to four weeks. We can run them as a one-off or as a recurring programme — if you want the latter, see the annual programme.
Send the scope and timing.
Tell us what needs testing, the environment involved, and any deadline. We will respond with the questions needed to define the work.