Services

We break it first.

The same people who build Zero Door test, attack and train. Every engagement ends with evidence you can act on, not a slide deck.

Talk to us Read our research

gaprule added

Penetration testing

Scope: External and internal networks, web and mobile applications, APIs, cloud configurations. Scoped with you, executed manually with tooling where it helps.

What you get

A report with reproducible steps, severity by real impact, and a retest of every fixed finding.

How it runs

01Scoping call and rules of engagement
02Testing window with daily status
03Report, walkthrough and retest

reportretested

criticalBroken access control on invoice downloadfixed
highSQL injection in order searchfixed
highAdmin panel reachable from the internetfixed
mediumOutdated TLS configurationfixed

Red team engagements

Scope: Objective-based operations against your organisation: initial access, persistence, lateral movement and exfiltration, physical and wireless where agreed. Our published research on kiosks and wardriving comes from this practice.

What you get

An attack narrative your defenders can replay, detection gaps with concrete fixes, and a joint debrief with your blue team.

How it runs

01Objectives, safety limits and legal cover
02Operation with a live deconfliction line
03Debrief, replay and detection engineering

attack narrative

initial access

persistence

lateral movement

exfiltration

detection

rule addedrule added

Security training

Scope: Hands-on courses for engineers and operators: Linux and Windows integrity, malware behaviour, incident evidence handling, secure operations behind an air gap.

What you get

Lab environments participants keep, and an assessment of what changed in their daily practice.

How it runs

01Level and audience assessment
02On-site or remote sessions with labs
03Follow-up review after four weeks

lab environment

01Find the altered binary on a Linux hostdone
02Trace a signed but malicious DLLdone
03Watch malware behave in a sandboxdone
04Hand over evidence with a chain of custodydone

follow-up after four weeks

Consulting

Scope: Compliance evidence design for PCI DSS, ISO 27001, GDPR and NIST, integrity monitoring architecture, and air-gapped operations.

What you get

A written design built to the controls your auditor tests, that your team can run without us.

How it runs

01Current-state review
02Design and control mapping
03Handover with runbooks

File integrity
Permissions
Audit trail
Change windows

PCI DSS
ISO 27001
GDPR
NIST

runbooks handed over

From this practice

Published red team research.

Tell us what keeps you up at night.

We reply within one working day and scope every engagement in writing.

Talk to us