Break it like a hacker. Fix it like an engineer.

Experienced consultants, augmented by intelligent systems

Expert-led penetration testing, supported by AI-assisted analysis, to uncover real weaknesses and strengthen systems against real-world threats

Arrange an expert review

Quick Facts

Founded in

2015

Led by consultants with decades of experience

Trusted by dozens of leading technology organisations globally

One Assessment, Calibrated to Your Threat Model

We deliver a single core service: advanced penetration testing.

‍

Each engagement is tailored by combining three methodologies - dialed up or down based on your environment, threat model, and objectives.

Security Auditing

Pragmatic analysis of source code, binaries, and live systems. Expert manual review, augmented by AI and custom tooling, to uncover what others miss and fortify systems against real-world threats.

‍When we use this:

New product or feature launches · Pre-acquisition due diligence · Periodic security assurance and compliance

View Methodology

Adversary Simulation

Realistic attack simulations that test detection and response. Collaborative purple-team exercises to validate what’s working, expose gaps and weaknesses, and strengthen your response before attackers do

‍When we use this:

High-impact threat validation · SOC & IR response evaluation · Security control assurance

View methodology

Applied Research

Security analysis where existing playbooks fall short. Led by expert researchers with deep field experience, developing custom methodologies for complex and emerging systems with limited public guidance.

‍When we use this:

Novel technology assurance · Safety-critical risk exploration · Research-driven validation

View methodology

elttam Intelligence Platform

Our internal intelligence system

Built from years of research, engineering, and hands-on security work, it augments our consultants with shared insight and AI-assisted analysis strengthening every assessment we deliver.

What all the fuss is about

READ ARTICLE

Latest from Our Resources

VIEW ALL ARTICLES

elttam

March 25, 2026

Talkback

talkback

Alex Brown

December 18, 2025

ORM Leaking More Than You Joined For

A follow-up article in our ORM Leaks series covering newly susceptible ORMs, techniques for bypassing ORM Leak protections, and demonstrating how ORM Leaks can exist in any web application that uses one.

ORM

ORM Leaks

web

Jia Hao Poh

November 17, 2025

Gotchas in Email Parsing - Lessons From Jakarta Mail

This writeup goes through the various primitives in Jakarta Mail that could lead to high impact bugs if developers are unaware of the library's quirks. Primitives discussed here can be applied to other mail parsing libraries.

web

java

jakarta mail

input validation

footguns

We work best with:

Organisations building systems that people rely on today and into the future.

Widely used + trusted technologies

Well-known brands and platform providers behind products, services, and infrastructure used at scale - where security failures would have real-world impact.

Learn More

Builders of emerging technology

Teams developing new or complex systems - including AI-enabled platforms, robotics, aerospace, and other safety- or mission-critical technologies - where established security playbooks don’t yet apply.

Learn More

Critical Infrastructure

Organisations responsible for essential services - energy, transport, utilities, and communications, where security failures can disrupt communities, safety, and economic stability.

Learn More

High-growth and scaling teams

Rapidly scaling companies preparing for growth, scrutiny, or change who want a deep, credible assessment rather than a checkbox exercise.

Learn More

Security product and platform vendors

Teams building security tooling and platforms who want an independent, high-quality assessment from specialists with deep offensive and research experience.

Learn More

Not sure which assessment you need?

If you know you want a serious, realistic evaluation but don’t yet know whether that means product testing, adversary simulation, or applied research. We can help you pick the right assessment and scope the work - get in touch to start a conversation.

Where our assessments make the biggest impact.

Break it like a hacker. Fix it like an engineer.

Quick Facts

One Assessment, Calibrated to Your Threat Model

Security Auditing

Adversary Simulation

Applied Research

In the News

What all the fuss is about

Latest from Our Resources

Talkback

ORM Leaking More Than You Joined For

Gotchas in Email Parsing - Lessons From Jakarta Mail