Cybersecurity
We test applications, APIs and infrastructure the way an attacker would, and deliver a report with vulnerabilities ranked by severity and the fixes to apply. We protect AI systems against prompt injection, tool abuse and data leaks. And we design secure software and servers from day one, because security added at the end costs more and protects less.
Three services, one goal: find the gaps before anyone else
Penetration testing and vulnerability assessment
Web apps, APIs, mobile apps and networks, following OWASP guides. Technical report with evidence and priorities, an executive summary and a retest after the fixes.
AI system security
Direct and indirect prompt injection, data exfiltration, agent tool abuse, jailbreaks. Red teaming of your assistant and tailored guardrails, mapped to the OWASP Top 10 for LLM Applications.
Secure by design and infrastructure
Threat modelling, code review, server and cloud hardening, secrets management, backup and disaster recovery, monitoring and release pipelines with automated checks.
Sample report
Scan in progress
Sample report
- High Indirect prompt injection in the AI assistant Open Fixed
- High Access to other customers’ data through the API Open Fixed
- Medium Session tokens not revoked on password change Open Fixed
- Medium Library with a known vulnerability (CVE) Open Fixed
- Low Missing HTTP security headers Open Fixed
Illustrative simulation: no real customer data.
We do it in our own code first
- Data isolated per customer A separate database schema for each company, or row-level access rules: nobody reads anyone else’s data.
- Encrypted secrets Third-party credentials and tokens encrypted with AES-256-GCM, never in plain text in code or logs.
- Signatures everywhere Webhooks verified with HMAC signatures, signed links, device firmware signed with RSA-3072.
- Controlled releases Deploys only run if automated checks pass, with keys restricted to the bare minimum.
Technologies
Frequently asked questions
What is a penetration test?
It is a simulated, authorised attack on an application, an API or a network, to find out which vulnerabilities an attacker could really exploit. It ends with a report listing the gaps found, how severe they are and how to fix them.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment looks for and ranks known vulnerabilities, broadly and largely automatically. A penetration test tries to exploit them, chaining them as an attacker would, to measure the real damage. It often makes sense to start with the first and go deeper with the second.
How do you protect an AI agent from prompt injection?
By treating every external text as untrusted, limiting the tools the agent can use to the user’s permissions, requiring confirmation for risky actions and checking what leaves the system. Then you attack it on purpose, with red teaming, to verify the defences hold.
Do you test software built by other vendors?
Yes. We test applications, APIs and infrastructure from any vendor, with a written scope and authorisation agreed before we start.
Tell us what you want to build.
Write a few lines about your project: we will reply personally to set up a first call.