Research & write-ups
What our testers learn in the field, from cryptographic failures to evading endpoint defences.
Vibe Coded, Not Vetted
AI assistants build features that work. In a recent assessment of a vibe-coded app, the same four security shortcuts kept showing up.
Cryptographic Failure Leading to Admin Account Takeover
From a real assessment: a flawed "stay logged in" cookie let a standard user forge a valid cookie for the administrator account.
Attacking Electronic Codebooks
Why ECB mode should not be used to protect data, with a worked attack on AES in ECB mode you can adapt for your own proofs of concept.
Mastering the Simulated Phishing Attack
Phishing is in over a third of breaches. Here is how to plan and run a simulated campaign that actually tests your defences.
Building an Obfuscator to Evade Windows Defender
Techniques a red teamer can use to get tooling past Windows Defender and AMSI during an engagement.
Big enough to serve you, small enough to know you.
Tell us what you need tested. We'll come back with a clear scope and quote.