Penetration testing
Penetration testing and offensive assessment
I test your applications, APIs, networks and cloud environments the way an attacker would. Every finding comes with steps your team can reproduce and a fix they can ship.
When to call
When teams ask for it.
- A release, audit or regulator needs independent evidence of testing
- Scanners report hundreds of issues and nobody knows which matter
- A new product or integration has never been tested by a human
- Workloads moved to the cloud and nobody has checked who can reach what
Scope
What it involves.
- Scoping the systems that matter, with clear rules of engagement
- Manual testing of web applications, APIs, mobile apps and networks
- Cloud security assessments: identity and access, misconfigurations, exposed services and the attack paths between them
- IoT and hardware testing: debug ports, firmware, radio links and the cloud that manages the devices
- Phishing simulations that show where a message is stopped, clicked or reported
- Findings reproduced step by step, ranked by real-world risk
- A debrief for engineers and a summary for leadership
How it works
How the work is done.
Every hop, from the browser to the database.
I work through each layer an attacker would touch on the way in, and show you exactly which route got through.
Outcome
What you have at the end.
A report your engineers can act on and your board can read, with each finding traced to evidence.
Usually for: Banks, payment providers, fintechs and software companies
Proof
Work and credentials behind it.
Case notes
Certifications
- EC-CouncilCertified Ethical Hacker (Master)
- EC-CouncilCertified Ethical Hacker (Practical)
- Cyber Warfare LabsCertified Multi-Cloud Red Teaming Analyst
- Cyber Warfare LabsCertified Multi-Cloud Blue Team Analyst
- APIsec UniversityCertified API Security Analyst
- APIsec UniversityAPIsec Certified Practitioner
- The SecOps GroupCertified AppSec Practitioner (Merit)
Writing
Other services
Other ways I can help.
- Security operationsDetection engineering, SIEM, incident handling and malware analysis.
- GRC advisoryInformation system audits, ISO/IEC 27001 and security strategy.
- Agentic AI securitySecuring AI agents and LLM features, and automating the security work itself.
- Training and speakingSecurity awareness, technical workshops and conference talks.
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.