Services

Work with us

Four kinds of engagement, all run by the people who did the research on this site. Every finding comes with a reproduction and a reason it matters, ranked by whether an attacker can actually reach it.

Start an engagement See a sample report

S/00What we do

S/01

AI agent and MCP security review

ForTeams shipping agents, copilots or MCP servers into production.

What we look at

Prompt injection through tool output, documents, issues and web content
Tool misuse and excessive agency: what the model can do that it should not
MCP transport and authentication, session handling, exposed endpoints
Secrets and credentials reachable from the agent's context
Model-supplied values reaching file, shell and network sinks

You get

A report with reproducible findings ranked by exploitability, concrete fixes, and a retest once they land.

Proof Our notes on MCP transport security →

S/02

MCP deception with honeymcp

ForSecurity teams who want to see what attackers do to agent infrastructure, not guess.

What we look at

Persona selection and placement in your environment
Detector tuning against your real traffic
STIX 2.1 export into your SIEM or threat intel platform
A runbook for what to do when a sensor fires

You get

Running sensors, a tuned detector set and a written runbook. The tool is open source, so nothing is locked in.

Proof honeymcp on GitHub →

S/03

Exploitability-first triage

ForTeams drowning in scanner output who need to know what is real.

What we look at

Reachability of each reported vulnerability from an attacker's position
Which dependency findings sit on code paths you actually execute
What can safely wait, with the reasoning written down

You get

A short ranked list of what is reachable and why, instead of a long list of what exists.

S/04

Kernel and systems fuzzing

ForVendors and platform teams who own kernel, driver or network stack code.

What we look at

Targeted fuzzing campaigns with syzkaller and KASAN
Crash triage and deduplication down to root cause
Patches written and taken upstream where the code is open

You get

Triaged crashes with reproductions, root-cause analysis and, where possible, an accepted fix.

Proof Our CVEs in Linux and Apple →

S/05How an engagement runs

01Scoping callThirty minutes on what you are building and what worries you. No preparation needed.
02Written scope and priceWhat is in, what is out, the timeline and the price, agreed in writing before any work starts.
03TestingAnything critical is reported the day we confirm it, not saved for the final report.
04Report and retestFindings with reproductions and fixes, then a retest once your changes land.

S/06What the deliverable looks like

A sample report

An illustrative report against a fictional system, built from the bug classes we write about. It shows the format: severity, reachability, reproduction, fix and retest status for each finding.

Open the sample report

Microsoft cloud We also resell and support Microsoft 365 and Azure. Existing customers use the support desk for licences, tenants and billing. Go to support →

S/07Start an engagement