Principle-based security research. The same methodology behind 79 CVEs, 5 Linux kernel patches, and the AATMF framework — applied to your systems. We do a small number of engagements. Every one ships operational findings.
End-to-end adversarial testing of LLM-based systems — from raw model APIs to production agentic pipelines. Built on the AATMF framework: 15 tactics, 240+ techniques, structured scoring with AATMF-R.
Where most real-world compromise actually happens.
Targeted security assessment of cloud-native infrastructure, web applications, APIs, and SaaS platforms. Kubernetes clusters, container runtimes, CI/CD pipelines, IAM misconfigurations, and OSS dependency chains. 79 CVEs across 7 ecosystems.
The human layer is in scope.
Human-layer security testing using the SEF methodology. Phishing, vishing, physical, and hybrid campaigns scored against the SESA rubric with HLTM threat modeling.
Catch it at design review, not in production.
Principle-based SSDLC consulting. We don't hand you a checklist — we embed security into the development lifecycle at the points where vulnerabilities actually originate. Threat modeling, secure design review, code-level security architecture, and developer training grounded in real CVEs — including our own.
Depth, not surface.
Deep-stack vulnerability research: Linux kernel, device drivers, network subsystems, container runtimes. 5 mainline kernel patches. The kind of work that finds use-after-free in io_uring, not missing auth on a REST endpoint.
1. Scoping call — we define the target, the rules of engagement, and what "done" looks like. 30 minutes, no commitment.
2. Research phase — principle-based, not checklist-driven. We identify the underlying pattern, not just the surface finding. You get async updates, not silence.
3. Deliverable — operational findings, not compliance filler. Every finding reproduces. Every report maps to standards your team already uses.
4. Debrief — we walk through findings with your team. Attack demos on request.
We decline more engagements than we accept. The bar isn't budget — it's whether the work is interesting and the customer will act on the findings.
Six writeups with dedicated quick-facts, FAQ, and references — for engineers landing here from a search for the CVE itself.