Offensive security services
Offensive security for the modern attack surface.
Human-led penetration testing across applications, infrastructure and AI systems, with evidence, impact and remediation at the centre.
Request a pentestSix attack surfaces
Test the systems that build your business.
Every engagement is scoped individually. Pick whichever is closest and we'll settle the rest on the scoping call.
- 01
Web Applications
Manual security testing for modern web applications, portals and business-critical workflows.
- OWASP Top 10
- Authentication & sessions
- Business logic
- 02
APIs (REST / GraphQL)
Assess REST, GraphQL and service APIs for authorization, authentication, data exposure and logic flaws.
- BOLA / BFLA
- Token handling
- Rate limiting
- 03
Mobile Applications
Assess Android and iOS applications with static, dynamic and runtime techniques.
- Static & dynamic analysis
- Reverse engineering
- Secure storage
- 04
Cloud & Infrastructure
Security testing across cloud configurations, identities, workloads and exposed infrastructure.
- AWS / Azure / GCP
- IAM & privilege escalation
- Containers & Kubernetes
- 05
Internal & External Networks
Assess externally exposed services and internal trust boundaries under agreed rules of engagement.
- External attack surface
- Active Directory
- Lateral movement
- 06
AI & LLM Systems
Security testing for AI applications, LLM integrations, RAG pipelines, tools and agent-based systems.
- Prompt injection
- RAG security
- Agent & tool abuse
Included in every engagement
- An executive summary for leadership and the board
- A technical finding dossier with reproducible proof-of-concept steps
- An attestation of assessment letter for auditors and enterprise customers
- One retest within 30 days to verify remediation