Services

See what actually holds up.

Adversary-driven assessments aligned to NIST SP 800-115, PTES, OWASP and MITRE ATT&CK. Every engagement is scoped to your environment, priced as a fixed fee, and followed by remediation support and a retest.

Network Application & API AI Social Engineering Physical Red Team Wireless Purple Team Cloud OT / ICS Advisory & vCISO Remediation Digital Forensics

Network Penetration Testing

An adversary-driven test of your external and internal network that identifies and exploits real weaknesses — deeper and more targeted than a vulnerability scan.

1–3 weeks Remote External · Internal

Approach

External: reconnaissance, service enumeration, exploitation of internet-facing systems, and credential attacks against exposed services.
Internal: host discovery, Active Directory attacks, privilege escalation, lateral movement, and access to critical resources.
Validation of every finding to eliminate false positives and prove real impact.
Risk-ranking of findings mapped to your business context.

You receive

Executive summary, technical findings with evidence and reproduction steps, a prioritized remediation roadmap, and a live debrief.

Application & API Penetration Testing

Web applications and APIs assessed for exploitable flaws across authentication, authorization, input handling and business logic — aligned to the OWASP Testing Guide and ASVS.

1–2 weeks per app set Remote REST · GraphQL · SOAP

Approach

Authenticated and unauthenticated testing across every user role.
OWASP Top 10 and beyond — access control, injection, SSRF, and business-logic flaws.
API testing for REST, GraphQL and SOAP endpoints.
Exploitation to demonstrate real data or account exposure.

You receive

Findings by severity with proof-of-concept, remediation guidance per issue, and a debrief with your engineering team.

AI Penetration Testing

Assessment of LLM-powered applications, agents and the integrations around them — for the failure modes traditional testing doesn't cover. Aligned to the OWASP Top 10 for LLM Applications and MITRE ATLAS.

1–2 weeks per application Remote LLM · RAG · Agents

Approach

Direct and indirect prompt injection, jailbreaks, and system-prompt extraction.
Data leakage: sensitive information in responses, retrieval (RAG) and training-data exposure, cross-tenant access.
Excessive agency: abuse of tools, function calls and agent workflows to reach real systems and data.
Insecure output handling and the application around the model — how model output is trusted downstream, plus the usual auth and API weaknesses.

You receive

Findings with reproducible prompts and evidence, ranked by real impact, with remediation guidance for both the model layer and the application.

Physical Penetration Testing

On-site testing of physical controls — badges, locks, tailgating and facility access — to evaluate how far an intruder could get in person.

2–5 days per location On-site

Approach

Covert entry attempts, tailgating, and badge cloning where authorized.
Assessment of reception, visitor and escort procedures.
Access to sensitive areas, network jacks and unattended workstations.
Conducted under a signed authorization-to-test letter carried on site.

You receive

A narrative of access achieved, evidence, and practical physical-control recommendations.

Red Team

A goal-based, multi-vector adversary emulation that combines network, application, social and physical techniques to test your prevention and detection against a realistic threat.

3–6 weeks Objective-driven MITRE ATT&CK

Approach

Objective-driven — access to specific data or systems — rather than breadth-first.
Stealth and evasion to test detection and response, mapped to MITRE ATT&CK.
Multiple entry vectors chained toward the objective.
Optional purple-team collaboration to maximize defender learning.

You receive

Attack narrative, timeline, detection analysis, and strategic recommendations for leadership and your SOC.

Also available

Additional capabilities

Engagements can be combined into a single program. If you don't see exactly what you need, ask — we tailor.

Wireless Assessment

Rogue access points, encryption and authentication attacks, and guest/corporate segmentation testing.

Purple Team

Collaborative attack-and-defend exercises to tune your detections and playbooks in real time.

Cloud Security Review

Configuration and identity review across AWS, Azure and GCP against CIS Benchmarks and provider best practice.

OT / ICS Assessment

Safe, carefully scoped testing of operational technology environments, prioritizing availability and safety.

Advisory & vCISO

Risk assessments, compliance readiness (PCI, SOC 2, HIPAA) and fractional security leadership.

Remediation Services

Direct help closing the gaps we (or others) find — hardening, fixes, validation and retest.

Digital Forensics & Expert Witness

Forensic examination of computers, mobile devices and cloud accounts, documented in clear written reports, with expert consulting and testimony support for civil, corporate and legal matters.

How to work with us

Engagement models that fit

Project-based

Point-in-time validation

Defined-scope assessments — pen test, red team, app or wireless — delivered on a fixed timeline and a fixed price. Best for annual testing and compliance.

Testing-as-a-Service

Ongoing assurance

A continuous program of scheduled and on-demand testing under one agreement, at a lower blended rate. Best when testing needs to keep pace with change.

Advisory retainer

On-call expertise

vCISO, architecture and remediation guidance whenever you need it. Best for maturing a security program.

Next step

Not sure which one you need?

A 30-minute scoping call is usually enough to size the work and get you a fixed price.

Start a scoping call