Offensive Security

Crown-jewel modelling, custom attack paths, multi-phase operations over 4–16 weeks. Initial access via phishing, exposed services or physical entry; persistence, privilege escalation and lateral movement with in-house implants that do not appear in any vendor signature set.

APT28 identity-infrastructure tradecraft, Scattered Spider help-desk social engineering, Volt Typhoon living-off-the-land in OT-adjacent networks — executed from CTI, with your blue team watching or not. TIBER-EU and CBEST compatible.

Memory-safety and logic bugs in VPN concentrators, identity providers, HSM firmware and CI runners. 200+ CVEs, each with a working PoC, CWE and CVSS vector, disclosed on the 90-day clock. Exploits are written for the report, then destroyed.

AD CS abuse (ESC1–ESC16), Kerberos delegation and relay chains, Entra ID token and consent abuse, AD FS trust attacks of the kind exploited in CVE-2026-56155. Median time to domain admin across engagements: under 72 hours.

IAM privilege chains, IMDS and workload-identity abuse, container escape via Copy Fail-class kernel bugs (CVE-2026-31431), poisoned pipeline execution and runner takeover. Findings mapped to the CIS benchmark you are already measured against.

Isozaki et al. found neither Llama 3.1-405B nor GPT-4o completed a single end-to-end penetration test, even with human assistance. 2026 has shown frontier models accelerate bug discovery — Firefox shipped 61 and 76 AI-assisted patches in February and March — but not exploitation. We use models for triage and variant analysis, and operators for everything that touches your network.