Specialist security engineers for each target domain.
A web application, an iOS binary, an Active Directory forest, and an LLM pipeline require different offensive skill sets. We assign domain-specific security engineers to match the exact technology stack in your scope.
Specialist engineering disciplines
- Application & API Security
- Web applications, REST, GraphQL, gRPC, and OAuth/JWT flows
- Mobile Binary Reverse Engineering
- Android APK/AAB and iOS IPA static and dynamic instrumentation
- AI & LLM Adversarial Testing
- Prompt injection, RAG vector stores, and agent tool permissions
- Network, AD & Cloud Security
- Perimeters, internal VLANs, Active Directory, AWS, Azure, and GCP
- Thick Client & Binary Analysis
- .NET, Java, C++, and Electron desktop software and local IPC
Specialist roles across our seven practices
How our offensive security team is structured by technical discipline.
Web & API Application Security Engineers
Focus on modern web frameworks (React, Next.js, Angular, Node.js, Spring Boot, Django, .NET) and REST, GraphQL, and gRPC APIs. Specialize in multi-tenant authorization testing (IDOR/BOLA), OAuth/OIDC and JWT validation, server-side injection, and race condition testing.
Mobile Application Reverse Engineers (Android & iOS)
Focus on Android (Kotlin, Java) and iOS (Swift, Objective-C, Flutter, React Native) binaries. Specialize in static decompilation, dynamic runtime hooking with Frida and Objection, Keystore and Keychain verification, and certificate pinning analysis.
AI & LLM Security Researchers
Focus on enterprise LLM applications, RAG architectures, vector databases, and tool-calling agents. Specialize in direct and indirect prompt injection, cross-tenant vector retrieval testing, system prompt isolation, and agent tool permission boundaries.
Network, Active Directory & Cloud Penetration Testers
Focus on enterprise network perimeters, internal VLAN segmentation, Linux and Windows servers, Active Directory domains, and AWS, Azure, and GCP cloud environments. Specialize in lateral movement analysis, ADCS/Kerberos paths, and cloud IAM privilege escalation.
Thick Client & Binary Security Analysts
Focus on desktop applications built in .NET, Java, C/C++, and Electron. Specialize in binary reverse engineering, process memory and heap inspection, DLL hijacking, Windows service privilege escalation, and custom TCP/IPC protocol analysis.
Standards and toolchains we use
Every assessment follows established industry benchmarks and combines commercial and open-source offensive tooling with custom scripts.
Web & API testing
Aligned with OWASP Web Security Testing Guide (WSTG), OWASP ASVS, and OWASP API Security Top 10 using Burp Suite Pro, Postman, GraphQL Raider, and custom HTTP/2 fuzzers.
Mobile testing (Android & iOS)
Aligned with OWASP MASVS and MASTG using JADX, MobSF, Frida, Objection, Hopper/Ghidra, and physical rooted Android and jailbroken iOS test devices.
AI & LLM testing
Aligned with OWASP Top 10 for LLM Applications and MITRE ATLAS using custom adversarial prompt harnesses, RAG boundary tests, and tool-invocation monitors.
Network, server & cloud testing
Aligned with PTES, NIST SP 800-115, and CIS Benchmarks using Nmap, Nessus, BloodHound, Impacket, NetExec, ScoutSuite, and Prowler.
Thick client testing
Using dnSpy, ILSpy, Ghidra, x64dbg, WinDbg, Process Monitor (Procmon), Wireshark, and custom network proxy relays.