Web & API testing
Business logic, auth, injection and access-control flaws, OWASP and beyond.
RED TEAM // ENGAGEMENTS OPEN FOR Q4
We break in so they can’t.
Offensive security consultants who test your apps, networks, cloud and people the way real attackers do, then help you close every door we opened.
2,140critical findings reported since 2016
01 — Engagements
Pick a target. We’ll find the way in.
Network & AD
Internal and external infrastructure, Active Directory and segmentation.
Cloud configuration
IAM paths, storage exposure and misconfigurations across your cloud accounts.
Mobile apps
iOS and Android binaries, storage, transport and backend APIs.
Red team
Goal-based, multi-week adversary simulation against your detection and response.
Social engineering
Phishing, vishing and physical access tests with awareness debriefs.
02 — Method
The same kill chain attackers use. With a rulebook.
Every engagement follows a written rules-of-engagement, a named lead and daily status updates.
- 01
RECON
Map the attack surface: hosts, people, code and cloud.
- 02
WEAPONISE
Build payloads tailored to your stack and controls.
- 03
EXPLOIT
Break in the way a real adversary would. Safely.
- 04
PIVOT
Move laterally to prove true business impact.
- 05
REPORT
Findings ranked by risk with copy-paste fixes.
- 06
RETEST
Free retest of every fix within 90 days.
03 — Reporting
Reports your engineers will actually read.
Each finding comes with evidence, business impact, a severity score and a fix written for the developer who owns it.
- Executive summary for the board, technical detail for the team
- Findings exported to your issue tracker
- Retest letter for auditors and customers
Authentication bypass via JWT algorithm confusion
- Asset
- api.arcline.example /v2/session
- Impact
- Full account takeover of any user, including admins
- Status
- Fix verified on retest
# Proof of concept (redacted)
header = {"alg": "HS256", "typ": "JWT"}
sig = hmac(public_key_pem, payload) # accepted ✗Fix: pin the expected algorithm server-side and reject tokens whose header does not match.
640+Engagements delivered
2140Critical findings
98%Clients who rebook
38Full-time testers
04 — Testers
Humans, not scanners.
Every tester holds advanced offensive certifications and has shipped production code.
Rhea Solberg
Head of offensive security
Daniel Okafor
Principal red teamer
Mina Castell
Application security lead
Jonas Brekke
Cloud & AD specialist
05 — Proof
What clients say after the debrief.
We replaced a SIEM, an MDR contract and two dashboards with one Cipheron pod. Alert noise dropped by 92%.
Tomas ReinerHead of IT, Arcline Logistics
Their pentest found an auth bypass three other vendors missed, then retested the fix within 48 hours at no cost.
Aisha ColemanVP Engineering, Kestrel Health
Zero-trust rollout took eleven days for 1,400 staff. Nobody filed a ticket about VPNs again.
Marcus DahlIT Director, Halden Retail
cipheron@soc:~$ ./engage --now
Find the hole before someone else does.
Free 30-minute scoping call. Fixed-price proposal within 48 hours.