Authorised offensive security

An ethical hacker you can actually trust

We are a small, senior team of authorised ethical hackers. Because seniors do the work, you get real attack chains. Moreover, the person who ran the test briefs you, so you never receive a scanner printout from a project manager.

Authorised scope only NDA-first, confidential Insured to $10M
engagement · session log
An ethical hacker reviewing a live terminal session during an authorised penetration test
48hfrom kickoff to first validated finding, typical engagement

Held to the standards serious buyers verify

OSCPOffSec certified OSEPevasion & exploit-dev CRESTaccredited testing OWASPweb methodology PTESexecution standard
Why trust comes first

Why trust decides who you hire as an ethical hacker

Handing an outsider access to your systems is an act of trust before it is a purchase. Therefore everything about how we work is built to earn it. In addition, every claim here is one you can verify.

Authorised, always

We test only systems you own or are explicitly authorised to test, because that is what keeps the work lawful. So there is a signed scope of work first, and no unauthorised access, ever.

Named senior principals

The person you speak with is also the person on your keyboard. Since there is no junior bench and no offshore hand-off, you know exactly who is testing. Moreover, you get the tester's name, certifications, and track record before you commit.

Confidential by default

We sign your NDA before any technical discussion. Furthermore, we never publish a client name without written permission, and we do not retain your findings after delivery. In short, discretion is the product.

Methodology

What an ethical hacker actually does

A real engagement is a structured adversarial simulation, not a scan. Because depth matters, we follow the Penetration Testing Execution Standard. Moreover, every phase is manual-led where it counts.

01Scope

Authorisation and rules of engagement

First we agree exactly which systems are in and out of scope. We also fix permitted methods, timing, and evidence handling. Since authorisation matters, the system owner signs it in writing before anyone touches a keyboard.

02Recon

Map the real attack surface

We enumerate what an actual adversary would see: exposed services, forgotten subdomains, leaked credentials, and the human paths in. Most breaches start with something the asset owner forgot existed.

03Exploit

Chain the findings into real impact

A single open port is only noise. Therefore we prove the chain, showing how one weakness leads to the next. As a result you see real impact on your business, and every step is reproducible.

04Report

Briefed in person by the lead tester

You get a redacted-quality report with risk context and remediation, walked through by the person who ran the test. Then a complimentary retest once you have fixed what we found.

Engagements

Where our ethical hackers are engaged

Every engagement is scoped to your threat model, because we do not apply a generic playbook. In short, these are the mandates we take on most often.

Web & API penetration testing

Applications, authentication, and the APIs behind them, tested to OWASP depth against your real business logic.

Network & cloud assessment

Internal and external infrastructure, cloud configuration, and segmentation, that is, the paths a real intruder pivots through.

Red-team & adversary simulation

A full-scope, objective-driven simulation of a determined attacker, because people, process, and technology fail together.

Executive & private-client OPSEC

For founders, executives and high-net-worth individuals: personal footprint, home network, and device hardening against targeted attackers.

Who we work with

Enterprise-first, private clients by exception

Our institutional practice is our primary focus. We work with security teams inside large organisations, on retainer and on named engagements.

For private individuals such as founders, executives, and high-net-worth clients with a genuine threat model, we accept a small number of bespoke mandates each year. Because it matters, our most senior principals lead them directly. In short, it is the same enterprise-grade attention, opened to a handful of people who need it.

“We do not discount. We adjust scope.”

Every engagement is a fixed-fee project, priced after we understand your threat model. Since we do not bill hourly, the fee is never padded. Moreover, we reserve the right to decline work that does not fit our standards, so we take on only as many clients as our principals can fully attend to.

Proof, not promises

The work an ethical hacker should be judged on

Anyone can claim competence. Instead, we would rather show you a fragment of what we actually deliver. For example, here is a real finding, redacted, from an authorised engagement.

FINDING #04 · privilege escalation chainCRITICAL
# authorised engagement · scope: ████████████
[+] foothold via exposed CI runner token
[+] lateral move → ████████ service account
[+] secrets pulled from ██████████ vault path
[+] domain admin obtained · t+47h
impact: full control of production identity plane
remediation: 3 changes, 0 downtime → verified on retest

A Fortune 500 retail client, in 48 hours

On a recent authorised red-team engagement, our principals reached domain admin within 48 hours. Because it was a chain, no scanner would have flagged it. They then handed over three fixes that closed it with zero downtime. Names stay confidential, since the method is what we are hired for.

100%of engagements led by a named senior principal
0findings retained after delivery
Engagement pricing

Fixed-fee, scoped to your threat model

from $25,000
Most engagements fall between $35,000 and $120,000, depending on scope.

We quote a fixed fee after a scoping conversation, so there is no hourly billing and no surprises. However, if your budget is under $15,000, we are likely not the right fit, and we will say so plainly.

Trust & security

Commitments we put in writing

These are the reassurances a buyer of sensitive work needs. Moreover, they are stated plainly here, because they should not be buried in the terms.

  • NDA as standardSigned before any technical discussion. No exceptions.
  • No retention of findingsYour data and results are deleted on project completion.
  • Encrypted throughoutAll communication and deliverables move over encrypted channels.
  • InsuredProfessional indemnity and cyber liability cover on every engagement.
  • Background-checked staffEvery practitioner is vetted before they touch a client system.
  • No subcontractingAll testing is done in-house, so there are no offshore juniors and no hand-offs.
Start here

Request a scoping conversation

Tell us what you need to protect and what you are trying to prevent. A senior principal reviews every inquiry personally. We accept a limited number of engagements, so the more specific you are, the faster we can tell you whether we are the right firm.

Minimum engagement: $25,000

Fixed-fee projects only. We do not offer hourly consulting or one-off scans.

We conduct authorised assessments only, on systems you own or are explicitly authorised to test. Therefore we do not access accounts that are not yours, surveil individuals, or recover third-party accounts. We will not respond to requests of that kind.

Our minimum engagement is $25,000. A range is fine, because it helps us scope the right depth.

A senior principal replies within one business day. We accept a limited number of engagements.

Questions

Questions about hiring an ethical hacker

Is hiring an ethical hacker legal?

Yes, when the work is authorised. A legitimate ethical hacker tests only systems the client owns or has explicit written permission to test. Because authorisation is the line, it separates lawful security testing from a computer-misuse offence, so we require it before any engagement begins.

What is your ethical hacker code of conduct?

We test only within an agreed, written scope; we never access accounts or data outside it; we report findings only to you; we retain nothing after delivery; and we decline any request that would involve unauthorised access, surveillance of individuals, or recovering accounts that are not the client's. It is non-negotiable, and it is what keeps both sides protected.

Will you work with individuals, or only companies?

Our primary practice is institutional, but we accept a small number of private-client mandates each year for founders, executives and high-net-worth individuals with a real threat model. The engagement is led by a senior principal and priced the same way as our enterprise work.

How much does an engagement cost?

Engagements start at $25,000, and most fall between $35,000 and $120,000, depending on scope. We quote a fixed fee after a scoping conversation, so there is no hourly billing. However, if your budget is materially below the minimum, we will tell you honestly, and where we can we point you to a better-suited firm.

What do I actually receive?

You receive a findings report with reproducible attack chains, business-risk context, and prioritised remediation. Moreover, the tester who ran the engagement briefs you in person. Then, once you have applied the fixes, a complimentary retest confirms them.