Offensive security consultancy
Nullpath Security is an offensive security practice. We run penetration tests, red team engagements, vulnerability assessments and exploit research against the systems your business depends on, then hand your engineers a fix path they can act on before somebody else finds the same route in.
nullpath://engagement/lifecycle
5 phases
Discovery
Threat model summary for the target environment
Scope and rules of engagement
Signed rules of engagement with authorisation to test
Testing
Progress notes at agreed checkpoints throughout the engagement
Reporting
Technical findings with evidence, reproduction steps and CVSS v3.1 ratings
Remediation guidance
Live walkthrough and follow-up support for the engineering team
Methodology anchored in
PTES
Penetration Testing Execution Standard
WSTG
OWASP Web Security Testing Guide
ASVS
OWASP Application Security Verification Standard
ATT&CK
MITRE adversary tactics and techniques
800-115
NIST technical guide to security testing
CIS
CIS platform hardening benchmarks
01What we do
Each engagement is scoped against a threat model rather than a product tier. If a shorter assessment answers your question honestly, we will tell you that instead of selling you a red team.
All services in detail02How we operate
Offensive work puts a supplier inside your systems with permission to break things. These are the commitments we make before that starts, and they sit in the contract rather than on a slide.
No traffic leaves our infrastructure until rules of engagement are signed, scope is documented and emergency stop contacts are agreed.
Anything critical is escalated out of band the moment it is confirmed, with enough detail to act on before the engagement finishes.
Remediated findings are retested and the report reissued within 90 days, so the version you hand to a customer or auditor reflects the fixed state.
Engagement data is encrypted at rest, kept only for the agreed retention period, and destroyed on request with written confirmation.
Consultants are certified in the discipline they are staffed on.
03Client accounts
They chained three findings we had each rated low into a full account takeover, then showed us the exact request that did it. Our previous supplier had reported two of those same issues and closed them as informational. The report went straight into our sprint board without translation.
VP Engineering
Series B payments platform
Web application and API penetration test
The value was not the initial access, it was the timeline. Seeing exactly which of our alerts fired, which ones nobody looked at for eleven hours, and which stages produced no telemetry at all changed how we spend our detection budget.
Head of Information Security
UK insurance group
Red team engagement and purple team replay
Client names are withheld under non-disclosure agreement. Named references are available on request once an engagement reaches scoping.
04Research notes
An annual penetration test measures the estate as it stood on one morning in March. Cloud accounts, DNS records and third party integrations change every week, so the gap between that report and reality starts widening the day it is delivered. Continuous discovery is what keeps the gap small.
7 minute read
A penetration test asks how much of a system is broken. A red team engagement asks whether anyone would notice a competent operator coming for a specific objective. Choosing the wrong one wastes the budget and produces a report nobody can act on.
8 minute read
Most internal assessments reach domain admin through configuration rather than a missing patch. Kerberoastable service accounts, permissive certificate templates, wide delegation, available NTLM relay and forgotten access control entries account for most of the paths we walk. All five are fixable in house.
8 minute read
Start here
Send us the shape of your environment and a rough deadline. A consultant replies within one business day with a scope, a window and a fixed price. No sales sequence, no discovery deck.