Find the
tracks first.
A boutique offensive-security firm helping growth-stage companies see the footprints adversaries leave — through penetration testing, red-team engagements, and pragmatic security consulting. Friendly. Rigorous. Never fear-driven.
Three things,
done well.
No platform, no upsells, no AI-generated reports. Just three offerings — each delivered by a senior practitioner who's seen the failure mode before.
Penetration Testing
Web, mobile, API, and cloud-native infra. Grey-box by default; black-box on request. Findings shipped live to your tracker — not at the end.
Red Team Engagement
Multi-week adversary simulation against your full stack. Phishing, lateral movement, detection-evasion — and the purple-team debrief that follows.
Security Consulting
Fractional CISO, threat-modeling workshops, architecture review, SDLC integration. Your engineers love working with our engineers.
Four steps.
No surprises.
We work in your repo, file findings as PRs with proof-of-concept code, and meet your team daily for fifteen minutes. The "report" is a living artifact — not a tombstone.
Scope & Scale
Two-hour kickoff. We define targets, rules of engagement, success criteria. PGP keys exchanged.
Active Testing
Daily 15-min sync. Findings filed live in your tracker as we discover them, not at the end.
Validate & Fix
Your team patches. We re-test. Most findings close before the engagement ends.
Delivery
Final report in 7 business days. Executive summary, technical detail, attestation letter.
Yeti shipped twelve PRs against findings during the engagement. Our previous pen-test gave us a PDF.
Things we've
been reading.
Field notes, threat briefs, and the occasional opinionated essay. No pop-ups, no email-gates.
Crampon-7: credential-stuffing wave targeting fleet-management SaaS
A coordinated campaign is replaying credentials from a 2025 breach against fleet-management SaaS login endpoints. Eleven known victims. Indicators inside.
The first six findings we see, every time
Across 38 engagements the same six issues appear in roughly the same order. Treat the list as a pre-emptive remediation roadmap.
Northstar Robotics: fixing twelve findings before the report shipped
How Northstar's platform team closed 71% of issues during a four-week pen-test — and why that matters for how we run engagements.