Boutique offensive security · Fully remote
Manual security testing for web applications, APIs, and AI/LLM features — delivered by certified practitioners, mapped to recognised standards, and backed by a verification retest on every engagement.
Engagement snapshot
On a recent SaaS engagement — a platform integrating with a major e-commerce advertising API — manual testing surfaced a privilege-escalation chain allowing full account takeover through role and token manipulation. Automated scanning had not flagged it, because exploiting it required understanding the application's business logic rather than matching a signature.
Eleven further findings were documented across session handling, input validation, and cloud storage configuration. Each was retested after remediation.
Findings by severity
Client identity and product details withheld under engagement confidentiality.
Services
We lead with manual penetration testing because business-logic flaws — the ones that cause real breaches — are invisible to automated tooling.
Core service
Manual, authenticated testing across your application's roles and trust boundaries — access control, session management, input handling, and business logic. Findings are CVSS-scored, mapped to the OWASP Top 10, and re-tested after your fixes land.
Explore this service →OWASP Top 10 · OWASP ASVS · CVSS v3.1
Emerging risk
Adversarial testing of chatbots, RAG pipelines, and agents — prompt injection, insecure output handling, excessive agency, and training or context data leakage.
Explore this service →OWASP Top 10 for LLM Applications
Infrastructure
Configuration review across AWS, GCP, and Azure — IAM and privilege boundaries, storage exposure, secret handling, and the model endpoints behind AI features.
Explore this service →CIS Benchmarks · Provider best practice
Broad coverage
Breadth-first identification and prioritisation across your estate, with every result manually triaged so you receive real issues rather than scanner noise.
Explore this service →CVSS v3.1 · Manual triage
Why it matters
Every engagement is executed by a certified practitioner. Tooling assists discovery; it never substitutes for exploitation and validation.
Findings carry CVSS v3.1 vectors and map to OWASP and STRIDE categories — so severity is defensible to your board and your customers.
Remediation is re-tested and each finding is formally marked fixed, partially fixed, or outstanding. You get evidence, not an assumption.
Offensive and cloud certifications in the same team means the application layer and the infrastructure under it are assessed together.
How we work
We agree targets, user roles, testing windows, and rules of engagement in writing before any testing begins — including what is explicitly out of scope.
Manual assessment across authenticated roles and trust boundaries, with critical findings reported as they are confirmed rather than held to the end.
A full report with an executive summary, per-finding reproduction steps, severity scoring, and specific remediation guidance your engineers can act on.
After your fixes are deployed, we re-test each finding and issue an updated report recording verified remediation status.
Tell us what you have built and we will come back with scoping questions, a proposed approach, and a timeline.
