What we do.
How we work.
Scoping & Threat Modelling
Understand your environment, your sector, and who would realistically target you. Build a threat model that shapes the engagement.
Testing & Exploitation
Test using the same techniques as the threat groups we profiled. Chain vulnerabilities across systems, networks, and applications into full attack paths.
Reporting & Debrief
Weekly updates during the engagement. Final report with proof of exploitation, business impact, and remediation path. We walk your team through it in a live debrief.
Remediation & Validation
We stick around. Work with your team to triage, answer questions during remediation, and re-test fixes to confirm they work.
Blog.
All postspublicly known vulnerable drivers still loaded into the kernel, with ASR in Block mode.
BYOVD: Detection and Prevention on a Hardened Windows 11 Endpoint
We tested Bring Your Own Vulnerable Driver against a fully hardened Windows 11 25H2 endpoint with MDE and ASR in Block mode. Publicly known vulnerable drivers still loaded and ran, killing Defender's PPL-protected processes.
Read the articleThe State of Exposed VPNs in Europe
We ran a Europe-wide responsible disclosure campaign to find organizations still exposed to known VPN vulnerabilities, trace the vulnerable devices to their owners, and get them patched. Around 800 organizations assessed. Only a minority responded.
wp2shell (CVE-2026-63030 & CVE-2026-60137): Unauthenticated SQL Injection in WordPress Core
wp2shell chains a REST API batch route confusion with a SQL injection in WP_Query into unauthenticated blind SQLi, now patched in WordPress Core. RCE is possible but not automatic. It needs a cracked admin password and plugin uploads enabled. Here is the real chain and how to patch it.
TIBER-EU and DORA: What Financial Institutions Need to Understand Before the Notification Arrives
DORA is live. TLPT regulatory standards are active. Notifications are being sent. Here is what financial institutions in the EU need to understand about TIBER-EU before the letter arrives.
Attestra AI Platform by OFFCEPT
Nothing reaches you unproven.
Attestra is our AI pentesting agent. It proposes findings, and every one has to survive an independent replay before it reaches your dashboard.
Claimed, then proven
Every finding starts as a claim. The exact request is replayed independently against a deterministic oracle before it is marked validated.
Undecided findings go to an operator
When the oracle cannot prove or disprove a claim, a person reviews it and makes the call.
Always running
Specialist agents work your whole attack surface in parallel, each on its own recurring schedule.
What clients say.
Every finding came with proof and a fix we could act on.
Working with OFFCEPT was straightforward from the first call. The engagement ran with real professionalism, and the report is the best we have ever received.
The kind of honest testing every product team needs.
We asked OFFCEPT to break our EDR the way a real attacker would. They found a way to take the agent offline, which is exactly the gap we wanted closed before release.
