OT · OPC UA
OPC UA security modes in practice
None, Sign or SignAndEncrypt: what an attacker sees in each mode, and which configuration we recommend.
Research note · Read →
Penetration testing · Attack Surface Management · OT security
A real attacker's perspective.
A real attacker's perspective.
Measurable security.
Offensive security testing from web applications through Active Directory to industrial control systems. You receive the findings on our client platform, where you can also track remediation, and we keep monitoring your external attack surface between engagements.
T1558.003 KERBEROASTINGADCS ESC1 → DOMAIN ADMINMODBUS FC16 WRITE MULTIPLE REGISTERSS7COMM PLC STOPSSRF → 169.254.169.254NTLM RELAY · SMB SIGNING OFFOPC UA SECURITYPOLICY#NONEIDOR /api/v1/invoices/{id}LLMNR POISONINGEXPOSED .ENV · AWS_SECRET_ACCESS_KEYPROMPT INJECTION → TOOL ABUSEVPN PORTAL CVE · NO MFABLOODHOUND: 3 HOPS TO DARDP 3389 EXPOSEDT1558.003 KERBEROASTINGADCS ESC1 → DOMAIN ADMINMODBUS FC16 WRITE MULTIPLE REGISTERSS7COMM PLC STOPSSRF → 169.254.169.254NTLM RELAY · SMB SIGNING OFFOPC UA SECURITYPOLICY#NONEIDOR /api/v1/invoices/{id}LLMNR POISONINGEXPOSED .ENV · AWS_SECRET_ACCESS_KEYPROMPT INJECTION → TOOL ABUSEVPN PORTAL CVE · NO MFABLOODHOUND: 3 HOPS TO DARDP 3389 EXPOSED
Expertise
Hands-on, manual testing. Automated tools are only a starting point; every finding is validated.
Safety
Written authorization, and a passive approach in industrial environments. Operational safety comes before every test.
Transparency
Public methodology and a fee agreed in advance.
Knowledge transfer
Beyond finding the issues, we prepare your team so they do not happen again.
Services
All services →Penetration testing and security assessment, from the application to the production line
Application Security
Web application, API, mobile and AI/LLM testing across every role, including business logic.
OWASP WSTGAPI Top 10MASVSLLM Top 10
Details →Network and Active Directory
External and internal pentests, assumed breach, and a documented attack path to Domain Admin.
KerberosADCSNTLM relayBloodHound
Details →Cloud and Microsoft 365
Configuration review of Entra ID, Exchange Online, SharePoint, Azure and AWS, including privilege escalation paths.
Entra IDConditional AccessAzureAWS
Details →OT / ICS Security
Passive OT assessment without disrupting production, PLC and OPC UA review, IEC 62443 segmentation.
IEC 62443ModbusS7OPC UA
Details →Continuous Attack Surface Monitoring
Weekly external scanning, alerts on new assets and critical findings, quarterly management report.
ASMChange alertsReporting
Details →NIS2 Readiness and Training
Supplier quick assessment, 90-day remediation plan, awareness and OT training, executive workshop.
NIS2Gap analysisTraining
Details →P1R4T3 Platform · PTaaS
About the platform →
Live findings instead of a one-off report
Findings appear on the MFA-protected client platform while testing is still in progress. There you can track remediation, request retests and export tasks to Jira. At the end of the project you receive a closure letter that you can share with partners or your auditor.
Live findingsduring the engagement
Retest requeststhrough the platform
Executive viewseverity and trends
Jira / CSV exportfor development teams
Attack Surface Managementbetween engagements
MFA and encryptionstrict client isolation
Why us
Offensive security and industrial expertise in one team
In-house OT lab
PLC modules, an OPC UA aggregator, an industrial network and a simulated manufacturing execution environment. Every technique is validated in our own lab first.
Our own tooling
A reconnaissance pipeline, honeypot infrastructure and a PTaaS platform. We automate repetitive steps so expert time goes into real analysis.
Public methodology
OWASP, MITRE ATT&CK, IEC 62443, NIST SP 800-82. Our testing methodology is public.
OWASPWSTG · ASVS · API Top 10
MITRE ATT&CKEnterprise and ICS
IEC 62443 · NIST SP 800-82OT frameworks
NIS2 · Hungarian Act LXIX of 2024compliance readiness
How we work
A transparent process from scoping to the closure letter
Scoping
A call and a questionnaire, followed by a written fixed-fee proposal.
Authorization
NDA, contract, exact scope and testing window.
Testing
Live findings on the platform and immediate notice of any critical issue.
Reporting
Executive and technical sections, after quality review.
Retest
Verification of the fixes, followed by a closure letter.
Research
Research and tools →Research and publications
Threat · PHP
PHP2Shell: critical PHP vulnerabilities
Unauthenticated remote code execution in every web-facing PHP deployment. Who is affected, what to do, what to look for in the logs.
Threat analysis · Read →
NIS2 · Suppliers
Ten pitfalls of the supplier questionnaire
What NIS2-regulated partners ask, and the mistakes we see most often in the answers.
Executive guide · Read →
Contact
Request a proposal
Briefly describe the system you would like tested and the reason for the engagement: a partner or regulatory requirement, an audit, or a new system going live. We will get back to you within one business day.
ConfidentialityNDA from the first call
Fixed feein writing, once the scope is agreed