Offensive security services
Penetration testing
for enterprise infrastructure
Manual testing on your network, your applications, your cloud, and the recovery chain nobody else tests.
- methodology
- PTES, OWASP, NIST 800-115
- findings
- verified by hand
- retest
- included, 90 days
- evidence
- Italian datacenter
- pricing
- fixed per engagement
Large enterprise
Multi site networks, Active Directory, ERP, virtualization clusters.
MSP and System Integrators
White label engagements, you stay the single point of contact.
Regulated organizations
NIS2, DORA, GDPR article 32, ISO 27001 control A.8.8.
One exposed service, five steps to your backups
This is the path we follow in most internal engagements. The last step is the one almost nobody tests, whether the company can actually come back.
Vulnerabilities with our name on them
The engineers who run your engagement also break software in public. Every identifier below is assigned, published and credited to our security team.
- 0
- Assigned CVE
- 0
- Rated critical
- 10.0
- Highest CVSS
Affected projects include Kubeflow, the machine learning platform for Kubernetes, and OpenWRT. Full list on carolillo.it.
- CVE-2026-54745 Unauthenticated SSRF and request smuggling in Kubeflow Pipelines 10.0
- CVE-2026-63631 Cross tenant takeover of the Kubeflow Model Registry 9.9
- CVE-2026-61621 ML engineer to node root in Kubeflow Trainer 9.9
- CVE-2026-63636 Cluster token theft through a tenant annotation in Model Registry 9.6
- CVE-2026-77596 Cross tenant pipeline injection in Kubeflow Pipelines 9.6
- CVE-2026-88980 Decimal IP SSRF reaching cloud metadata credentials 8.6
- CVE-2026-63391 Cross namespace pod injection in the Kubeflow Spark Operator 8.5
- CVE-2026-71860 Cross namespace object access in the Model Registry UI backend 8.4
- CVE-2024-51240 Admin to root on OpenWRT LuCI through the JSON-RPC API 8.0
- CVE-2026-88982 Cross tenant cache poisoning in Kubeflow Pipelines 6.4
What we test
Scope is agreed before anything starts. These are the areas we cover, in any combination.
Perimeter and applications
- Public IP ranges, VPN concentrators, mail and management gateways
- Web applications and API, OWASP Top 10 and API Top 10
- Business logic flaws and authorization bypass between tenants
Internal network and identity
- Active Directory, Kerberos abuse, credential reuse, privilege escalation
- Segmentation that only exists on the diagram
- Microsoft 365 and Entra ID, conditional access gaps, token theft paths
Kubernetes and ML platforms
- Multi tenant clusters, namespace isolation, RBAC and admission policy
- Service mesh authorization and in cluster service to service trust
- ML platforms and pipelines, where our published advisories come from
The backup and recovery chain
Ransomware operators go for the backups first. Most reports stop at the breach and never answer the question that decides whether the company survives it.
We attack the backup repository, the credentials that reach it and the restore procedure itself. Then we run the restore and verify the business actually comes back.
We can do this because running disaster recovery is our day job. The attack and the recovery are tested by the same team, in the same engagement.
How Sefthy disaster recovery worksHow we do it
Six phases, each one with a deliverable you can read. You always know where we are.
- 01
Scoping and rules of engagement
Targets, depth, test windows, emergency contacts and what is out of scope. Nothing starts without a signed authorization.
Signed authorization and scope
- 02
Reconnaissance and asset mapping
Passive and active discovery of the real attack surface. We routinely find assets the customer did not know were online.
Attack surface inventory
- 03
Vulnerability analysis
Automated scanning is the starting point, not the deliverable. Every finding is verified by hand to remove false positives.
Verified finding list
- 04
Controlled exploitation
We prove impact with the minimum necessary action, inside the agreed window, logging every step with timestamps.
Proof of concept evidence
- 05
Post exploitation and lateral movement
How far an attacker gets from the first foothold. Domain admin, ERP database, backup repository, hypervisor console.
Attack path narrative
- 06
Reporting, debrief and retest
Executive summary for the board, technical detail for the engineers, prioritized remediation. One retest included.
Report, debrief, retest letter
Engagement types
No prior knowledge, the external attacker scenario.
Standard user credentials, the insider and phished employee scenario.
Documentation, configurations and source. Maximum coverage per day spent.
Typical timeline
- Week 0Scoping and authorization
- Week 1-3Testing, with alerts on critical findings
- Week 4Report delivery and live debrief
- Week 8-12Retest and attestation letter
Critical findings reach you within 24 hours of discovery. We never wait for the final report.
Rules of engagement
Offensive work on production needs hard boundaries. These are ours, in writing, every time.
- Written authorization
- No activity before a signed rules of engagement document from an authorized signatory.
- Agreed windows
- Production testing runs in the windows you choose, with a named contact reachable throughout.
- No denial of service
- Availability attacks are excluded by default. If you want them tested, it happens on a dedicated environment.
- Data handling
- Evidence is encrypted at rest, kept in our Italian datacenter and destroyed 90 days after the retest.
- Full audit trail
- Every command and request is logged, so your team can reconcile our traffic against real incidents.
- Kill switch
- One call stops the engagement immediately, at any hour, for any reason.
Questions we get
Is a penetration test the same as a vulnerability scan?
No. A scan lists what might be wrong. A penetration test proves what an attacker can actually reach and do, with verified evidence and no false positives.
Can you test production systems safely?
Yes. Testing runs inside agreed windows, denial of service is excluded by default, and a named contact can stop the engagement at any moment.
Do you work for MSPs on behalf of their customers?
Yes. We run white label engagements where the MSP stays the single point of contact and the report can be delivered under the partner brand.
Is the retest included?
One retest of the confirmed findings is included within 90 days of the final report, together with an attestation letter for auditors and customers.
What makes your team different from a generalist consultancy?
We publish. Our engineers hold ten assigned CVE identifiers on cloud native and network software, five of them rated critical, including a CVSS 10.0. The same people run your engagement.
How is the engagement priced?
Fixed price per engagement, based on the scope and depth agreed during scoping. No hourly billing surprises and no per finding charges.
Start with a scoping call
Forty five minutes with the engineer who would run the test. We map the surface, agree the depth and send a fixed price proposal. Under NDA from the first email if you prefer.