What we do

Penetration testing, including the AI you just shipped

We test the systems you run for the ways a real attacker would get in, and report what we found with the proof to back it. We also test AI features most testers do not touch yet, like prompt injection and agents with access to your tools.

What we test*

01

Web apps and APIs

Authentication, access control and the OWASP classics, tested from the outside the way an attacker meets them, and from a logged-in account.

02

AI and LLM features

Prompt injection, jailbreaks, data exfiltration through the model, and agents that can be talked into misusing the tools and systems you gave them. If it took an instruction, we test what else it will take.

03

Source-code review

A white-box read of the code behind a finding, to show the exact file and line a bug lives on, not just that the symptom exists.

04

Cloud and infrastructure

Misconfiguration, identity and over-broad permissions across your cloud and the services around the app, within the scope we agree.

05

Findings you can act on

Every finding comes with the steps to reproduce it, the proof it is real and a fix, ranked by what it would actually cost you. We retest the fixes when you are ready.

* We don't issue compliance certificates or audit sign-offs. If an auditor needs a certified report for ISO 27001, SOC 2 or PCI DSS, you need an accredited firm. Our testing is for businesses that want to find their weak spots and fix them.

Authorized testing only

We test only systems you own or have written permission to test, inside a scope we agree before we start. We are in Byron Bay and work remotely with clients anywhere.

Let's talk

Tell us what you want tested, and what you are most worried someone could do.