Walid Badeges
FOUNDER & CEO
Built the practice out of one classroom in Bogor in 2019. Still reviews every report that goes near a regulator.
OSCPOSEP14 YRS
COMPANY - OUR TEAMS
Six squads. Named people. You know who is testing.
We do not sell an abstract "team". Before the contract is signed you get the roster: names, certifications, years, and who will write your report. No subcontracting, and no swapped names mid-engagement.
The team in numbers
39
FULL-TIME OPERATORS
61
ACTIVE CERTIFICATIONS
42
CVE & 0-DAY CREDITS
7.4
AVG YEARS ON THE JOB
0
SUBCONTRACTED ENGAGEMENTS
SQUAD STRUCTURE
Six squads, one team.
pick a squad to see who is in it and what it is scoped for
APPSEC - SCOPED FOR
Web, mobile and API surfaces where business logic is the real attack surface.
Our largest squad. Payment flows, customer portals, mobile apps and internal APIs - hunting authorisation abuse and flows that can be bent, not scanner output.
OWASP ASVSOWASP MASVSWSTGPTES
96
ENGAGEMENTS YTD
11 d
MEDIAN TO REPORT
2
REVIEWERS PER REPORT
TYPICAL SQUAD
Practice lead1
Senior operators2
Operators4
Report & retest analysts2
LEADERSHIP
Three people accountable for your outcome. Named in your proposal.
Jason
DIRECTOR OF ACADEMY
Turns engagement findings into curriculum, and finds the next operators among 40,000 community members.
OSCPOSWE9 YRS
Practice leads
full roster, with certifications, ships with your proposal
Luthfi Ahmad Paradiansyah
Reviewers
Payment flows, customer portals, API abuse
Bonar
DIRECTOR OF DELIVERY
Payment flows, customer portals, API abuse
CRTOOSEP11 YRS
Aditya Rafi Fauzi
Developers
Payment flows, customer portals, API abuse
14 YRS
Raihan Adi Arba
Developers
Payment flows, customer portals, API abuse
STAFFING
How your team gets assembled. Before anyone touches your systems.
Four steps between the scoping call and the first operator touching your systems.
01
Match the surface
The squad is chosen from what you actually run - not from who happens to be free.
02
Roster before signature
Names, certifications and years arrive inside the proposal. Substitutions only happen with your written approval.
03
Two sets of eyes
No finding leaves without a second operator reviewing it, and no report ships without the practice lead signing off.
04
Same team on retest
The operator who proved the issue verifies the fix, inside 14 days, at no extra cost.
SELECTION & VETTING
Nobody bills until they clear selection. Background checks and NDAs come first.
New operators come out of our own community and bootcamps, then run an internal track before they touch a client estate. That is why we can tell you what each person holds.
- Background check and NDA before access to any engagement
- A minimum of 40 internal lab hours and one shadowed engagement
- Controlled evidence handling: encrypted workstations, evidence destroyed on the retention schedule in your contract
- A quarterly research budget - certifications and 0-day time are company-paid
WE ARE HIRING
If you would rather be on this roster. Apply through the careers site.
Research, testing and teaching - most of our operators started as students in our own classes.
NEXT STEP
Find out what an attacker could reach today. Before someone else does.
A 30-minute scoping call with an operator. A written scope, timeline and indicative cost follow the call.