What you do not see is there too.
Solicita una evaluación de seguridad ofensiva: cuéntanos qué quieres poner a prueba, en qué plazo y en qué modalidad.
Ver serviciosWe test applications, people and everything your company left exposed without noticing. Every finding is demonstrated, prioritised by impact and tested again after you fix it.
Authentication, business logic, permission control and data exposure. We follow the paths that connect an apparently minor flaw to real impact on your operation.
Manual testing · Reproducible evidence · Impact prioritisation · RetestWhat stays on the device and what travels to your backend. We analyse the app and its connections to find where trust between the two breaks.
Static and dynamic analysis · Storage · Communications · APIsYour attack surface starts long before the login page. We connect public information, forgotten assets and digital footprint to understand what an adversary sees before the first attempt.
External inventory · Digital footprint · Public exposure · Risk pathsMentions of your brand, your employees' credentials and signs that someone is already preparing. We investigate open sources and closed spaces, and validate every signal before handing it to you.
Intelligence by scope · Finding validation · Context · RecommendationsAgreed phishing simulations and practical training for the people who face these threats every day. Every exercise ends in judgement to recognise them and respond in time.
Controlled simulation · Metrics · Workshops · Improvement planOriginal vulnerability research and proof of concept work on custom software. Not for hire yet: when it opens, it will open with published work behind it.
Every project starts with an agreed scope and explicit written authorisation. It ends with evidence, context and the concrete steps to close what we found.
Offensive security available for operations in Mexico, the United States, Europe and India. The same technical rigour, wherever you operate.
Our methodologyWe choose how to work with you before the first test. Scope, use of AI and the handling of your data are all put in writing.
Machine breadth.
Human judgement.
AI for reconnaissance, source correlation and prioritisation across the authorised scope.
A person exploits, chains and reproduces every finding. The technical decision is human.
Verifiable results, impact and remediation steps. Retest after you fix them.
For large attack surfaces, multiple applications and threat intelligence. AI helps with the volume work; specialists decide what deserves a test and what can be backed by evidence.
Human depth.
Data under control.
Reconnaissance and analysis by specialists, with tooling on controlled infrastructure.
Manual testing of permissions, business logic and attack chains within scope.
A report written by people, reproducible evidence and a statement of no AI use.
For sensitive information, strict confidentiality agreements and companies that need AI excluded from the service. Your code, data and findings stay on the agreed infrastructure.
| Criterion | AI-less | Hybrid AI |
|---|---|---|
| Use of AI | None, in any phase | Reconnaissance, correlation and prioritisation |
| Your data | Never sent to any model or third-party service | Only what the contract allows, redacted and never used for training |
| Exploitation | Human | Human |
| Finding validation | Manual | Manual |
| Coverage | Deep over a narrow scope | Broad over large surfaces |
| Pace | Slower per surface | Faster at volume |
| Best for | Regulated sectors and strict NDAs | Short deadlines and continuous monitoring |
Both modes start from written authorisation and end with verifiable evidence. Where your team sits does not change the agreed limits on your data.
Let us define your assessmentAn attacker does not follow a checklist, does not stop at six in the evening and does not hand over a PDF to satisfy an audit. That is the standard we work to, and that is the reason to hire us.
No sales layers, no juniors rotating through your project. The person testing your system is the same one who explains the finding and answers when your team asks.
A scanner hands you loose symptoms and false positives. We show you how far someone gets by chaining them: what data they reach, what privileges they gain and what they can do with them.
Every finding comes with steps to reproduce it, evidence, impact translated into your business and a concrete fix. The retest is included: we do not close until we confirm it is closed.
Scope and authorisation in writing before the first test, testing windows agreed with your team, a direct channel throughout the engagement and immediate notice if something critical appears. The aggression goes into the testing, never into how it is run.
We gather the people who research out of obsession rather than office hours. You get in here by showing work, so what reaches your company is the result of that obsession and not the CV of a partner you will never meet.
We do not deliver a report.
We deliver how far an attacker would have got.
Knull exists because the talent that actually finds things rarely has the CV that opens doors, and because too many companies are paying for audits nobody really carried out. We brought those people together and gave them a place where their work speaks first. What your company receives is that difference.
Request an assessmentA finding, a tool, a write-up, a piece of research nobody asked you to do. Show us how you think.
Curiosity that never switches off.
Rigour to prove it.
Judgement to act.
In AI-less no phase of the work passes through an artificial intelligence model: reconnaissance, exploitation, analysis and reporting are done by a person, and none of your data goes to third-party services. In Hybrid AI, AI handles the volume work — reconnaissance, source correlation, prioritisation — while exploitation and validation stay human. In both, no finding reaches the report without manual verification.
Only what the contract allows before we start. Information identifying your company or your people is redacted, the models used do not train on what is sent to them, and there is a record of what was processed. If you prefer that nothing leaves your perimeter, AI-less is the right mode.
A scanner reports isolated symptoms and false positives your team has to filter. Our work starts where the scanner stops: chaining those symptoms until we demonstrate what data is reached, what privileges are gained and how far someone already inside can go.
An agreed scope in writing, explicit authorisation from whoever can grant it over the assets to be tested, the testing windows and a technical contact for incidents. Without signed authorisation no test is run.
Every finding prioritised by business impact, the steps to reproduce it, the evidence, the recommended fix and an executive summary for whoever decides. It includes a retest of what was fixed and a session with your technical team.
Yes, before receiving any technical information. The AI-less mode exists precisely for the strictest agreements.
No. Selection is based on demonstrable work: a finding, a tool, a piece of research or a public write-up. We assess how you think, what you have built and how you document what you find.
