Security Testing
& Investigations
Test applications, APIs, and AI systems, investigate suspicious activity, and analyze software and threats. Agree the target, methods, evidence handling, and limits before work begins.
The work
Test weaknesses. Investigate events. Understand threats.
Penetration Testing & AI Security
Assess applications, APIs, and AI workflows. Test access controls, business logic, and permitted actions, then reproduce findings and retest agreed changes.
Vulnerability Research & Reverse Engineering
Analyze source code, patches, and agreed software targets. Explain behavior, investigate weaknesses, and document reproducible results with their prerequisites and limits.
Digital Forensics & Threat Intelligence
Reconstruct events from application and cloud evidence. Research relevant threats and connect supported findings to a timeline, confidence levels, and defensive priorities.
Follow the evidence to a practical next step
Choose a test, a software investigation, an incident review, or a threat assessment. Define the target systems, supplied evidence, access, permitted actions, collection and retention rules, response window, and stopping points before work begins. Production Readiness & Launch Support can coordinate the agreed security checks with release preparation. Specialist assessment methods, coverage, remediation, and retesting remain explicitly scoped.
Keep observations, hypotheses, and confirmed impact separate. Record sources, test conditions, negative results, confidence, and untested areas. Deliver findings and practical actions for the agreed question; verify changes when remediation and retesting are included.
Choose the scope that answers your question.
Penetration testing
Test web applications and APIs for weaknesses in authentication, authorization, data access, and business logic. Agree permitted exploitation and stopping points. Document supported impact, prioritize findings, and include remediation and retesting where agreed.
AI security assessments
Assess the application around a large language model. Test prompt injection, unauthorized retrieval, tool misuse, credential handling, and approval bypasses. Record the inputs, permissions, and conditions needed to reproduce each finding.
Vulnerability research & reverse engineering
Analyze source code, patches, and agreed software or protocol targets to explain behavior and investigate weaknesses. Review binary targets and lab requirements before accepting the scope. Record affected conditions, reproduction steps, negative results, and limits.
Digital forensics & incident investigation
Investigate application and cloud incidents using agreed logs, audit records, configuration history, and supplied artifacts. Record collection methods and evidence handling, reconstruct an event timeline, and distinguish supported findings from gaps. Agree the response window and access before work begins.
Threat intelligence & OSINT
Research a defined threat question using agreed public sources and supplied technical evidence. Assess relevance to the client’s assets, map attack methods where useful, and provide source references, confidence levels, and defensive priorities.
Smart contract security reviews & audits
Review an agreed code revision, intended behavior, dependencies, and threat model. Assess contract logic, permissions, upgrades, external calls, signatures, replay protection, and relevant oracle or economic assumptions. Combine manual review with suitable automated analysis and property tests.
The report records the revision, scope, methods, reproducible findings, severity rationale, remediation, retest status, and untested areas. Reviews of contracts we developed state our development role. An audit is a bounded technical assessment with stated coverage and limitations; it does not certify that a protocol is free of vulnerabilities.
Published research / Illustrative workflow
Follow a published finding through its controls
- 01
Source and patches
Compare the PHP session and destructor paths before and after the named security release.
- 02
Controlled reproduction
Use instrumented and separate stock-allocator labs. Record the serializer, gadget, memory, and address-source requirements.
- 03
Evidence and limits
Separate the observed memory error from the fixed-command lab result and from application paths that were blocked.
- 04
Retest
Use the documented controls to test the relevant change under the same stated conditions.
The PHP series records prior art, local lab results, application prerequisites, and negative results. It does not claim every application or attack path was covered.
Read the exampleWhat you receive
Evidence your engineers can act on.
An agreed question, target, method, access, evidence-handling rules, and engagement limits.
A record of test conditions, source references, collected evidence, and reproduction steps where applicable.
Supported findings with impact, confidence, negative results, gaps, and untested areas.
An event timeline or a sourced threat assessment when included in the investigation scope.
Prioritized remediation or defensive actions with clear next steps.
Verification of agreed security changes when remediation and retesting are included.
Selected work
Related work
Before we start
What must be agreed before testing?
Agree the authorized target, access, test conditions, permitted actions, and stopping points. A scoped assessment starts with a specific question and boundaries.
Does an assessment guarantee a vulnerability finding?
No. Report supported findings, negative results, prerequisites, and untested paths. The supplied system and agreed conditions determine what can be established.
Can remediation and retesting be included?
Yes. Agree the changes and repeat the relevant tests. Record the resulting behavior and the coverage limits instead of treating one passing test as complete assurance.
Can you assess an application we built with a third-party model?
Yes. The assessment can cover how your application uses that model, connects data, and permits actions.
Does the assessment cover the model or the application?
The scope covers your application’s inputs, retrieval, tools, permissions, credentials, and operator controls. It does not claim to audit the model provider’s internal systems.
How are findings verified?
Record the inputs, permissions, tool behavior, and conditions needed to reproduce a finding. Where fixes are included, repeat the relevant tests and document untested paths.
What can digital forensics cover?
The focus is application and cloud evidence: logs, audit records, configuration history, and supplied artifacts. Agree collection, retention, access, response timing, and deliverables first. Device acquisition, disk or memory imaging, and specialist malware analysis require a separate capability and scope review.
How is reverse engineering scoped?
Start with the question, the software or protocol target, available source or binaries, permissions, and lab needs. Confirm the analysis method and feasibility before accepting the engagement. The published PHP example demonstrates source and patch research; it is not a case study for every reverse-engineering target.
What does threat intelligence include?
A defined research question, agreed public sources and supplied evidence, relevance to your assets, confidence levels, and recommended actions. The scope can include OSINT and attack-method mapping. Conclusions must be supported by sources; attribution and completeness depend on the available evidence.
How does this relate to compliance and training?
Security Testing & Investigations assesses weaknesses, events, and threats. Compliance Engineering & Audit Readiness maps requirements to controls and review evidence. Technical Mentoring & Team Training develops the skills to apply these methods. Agree the required combination for your engagement.
Contact
Discuss a security engagement
Tell us your goal, context, and constraints. For a focused technical consultation, we agree the question, preparation, session scope, and written next steps before work begins.
Discuss your project