Reproducible, not anecdotal
Every finding carries vector, command, screenshot, time window and the exact conditions for reproduction. If your team cannot repeat it, I do not consider it closed.
Red teaming · TIBER-EU and DORA TLPT
Somebody is already assessing your perimeter.The difference is who hands you the report.
Adversary simulation against business objectives, aligned with TIBER-EU and the threat-led penetration testing DORA requires. Also AI platform pentesting, penetration testing, industrial security, DFIR and forensic expert witness work. Twenty-five years running the attacker's side for organisations that need evidence, not reassurance.
· TIBER-EU and DORA red teaming· NATO Locked Shields· Court expert witness· DFIR and CSIRT· OT/ICS environments· AI and agent pentesting· Security clearance
0+
Years on the offensive side of the industry
0
Service lines, almost always combined
0h
Maximum response time on a working day
0%
Findings verified by hand before delivery
Catalogue
Six lines of work
Almost every engagement combines two or three. An intrusion without social engineering leaves out the most profitable vector, and a simulation without a retest changes nothing.
How an attacker gets in
The chain your organisation has to break
No serious compromise happens in a single step. The attacker chains five phases, and breaking any one of them ends the operation. The work is finding out which of the five your organisation still fails to break.
01
Reconnaissance
What your organisation publishes without realising: forgotten assets, metadata, job adverts, leaked credentials.
02
Initial access
Targeted mail, an unpatched exposed service or a compromised supplier. It is almost never an exotic exploit.
03
Escalation
From unprivileged user to control of the directory. Certificate paths, delegation, passwords in attributes.
04
Movement
Hopping between segments to the system that actually matters. This is where segmentation fails.
05
Objective
Exfiltration, fraud or disruption. Once here, detection no longer helps anyone.
What you receive
A report that survives three different readings
The same finding has to hold up before your technical team, before your board, and — if it ends up there — before a court. I write for all three readers.
Evidence
Prioritisation
Real risk, not raw CVSS
The base score is adjusted for your exposure, your segmentation and your detection capability. An unreachable theoretical critical drops; a medium that chains to domain admin rises.
Continuity
Retest included
Verification of remediations and a formal closure record. Without the second pass, an intrusion report is a document, not a security improvement.
Reference framework
MITRE ATT&CK as a shared language
Every technique in the report is referenced by its ATT&CK identifier, so your defenders can map control coverage directly. The highlighted ones are those that appear most often in the engagements I run.
Initial access
SpearphishingExploit public appTrusted relationshipExternal remote serviceRemovable mediaExecution
Command interpreterScheduled taskWMIUser executionPersistence
Valid accountsNew serviceAccount manipulationBoot autostartPrivilege esc.
ADCS abuseKerberos delegationAccess tokenUAC bypassDefense evasion
Signed binaryIndicator removalObfuscationImpair defensesCredential access
LSASS dumpingKerberoastingNTLM captureBrute forceLateral movement
SMB / admin sharesPass-the-hashRDPWinRMImpact
Objective reachedSimulated exfiltrationEncryptionDestructionOn severity
Why your report will have fewer criticals
The typical distribution of one of my reports against that of a commercial scanner. Less noise does not mean less work: it means somebody checked by hand what is actually reachable in your environment before writing it down.
Indicative distribution · reflects the prioritisation criterion, not a market statistic
Critical8%
High22%
Medium41%
Low21%
Informational8%
Delivery capacity
One point of contact. A team behind it when needed.
Small and mid-sized engagements I run myself. When scope exceeds one person — multiple sites, compressed windows, long-duration red teams or an incident on several fronts — I mobilise the trusted teams I have worked with for years. You still have one technical owner and one report.
- Team composition is agreed with you before signature, with names, company and roles.
- All assigned personnel sign an engagement-specific confidentiality agreement.
- Scope, methodology and final drafting stay with me, whoever executes.
- If an engagement requires security clearance, cleared personnel are assigned or the engagement is declined.
Position
A single consultant, not a block of hours
Whoever negotiates the scope is the one who runs the intrusion and signs the report. There is no sales layer between you and the operator, and no junior learning on your infrastructure.
- Written rules of engagement before anything is touched: windows, excluded systems, stop criteria and emergency contact.
- Immediate notification on a critical finding or any indication of prior compromise. It does not wait for the final report.
- Full traceability of offensive activity so your SOC can reconcile its detections.
- Certified destruction of collected material at engagement closure.
Frequently asked
What clients ask before signing
Do you work alone or with a team?
Small and mid-sized engagements I run end to end myself. When scope exceeds one person — multiple sites, a compressed window, a long-duration red team or an incident on several fronts — I mobilise cells of two to five operators through Minery Report and Jaymon Security, two teams of military origin I have worked with for years. Composition is agreed with you in writing before signature, with names and roles, and your point of contact, the method and the report author stay the same.
How soon can an engagement start?
For a planned assessment, two to four weeks from signature, depending on the window your operation needs. For a live incident, the same day: those threads are handled outside business hours and the first call is always free, because the decisions made in the first hours determine the total cost of the incident.
Will you sign an NDA?
Yes, before any technical conversation, and you do not need to ask. All assigned personnel additionally sign an engagement-specific agreement. On closure a certificate of destruction of collected material is issued. No identifiable client reference appears on this site or in commercial material — which is why you will find no logos and no named case studies here.
Can you bid for public tenders?
Yes, both directly and as part of a joint venture through those teams. Both hold personnel with Spanish National Security Authority personal security clearance at Secret and at Confidential level, a common requirement in defence, critical infrastructure and classified government procurement. Technical direction additionally holds clearance at a level permitting the handling of classified information at the highest tier. Tell me the level required and the subject of the contract and I will confirm whether we can bid and with what composition.
What do you need in order to quote?
Sector, approximate asset or headcount figures, the engagement type you are considering and the reason behind it: certification, a client requirement, a previous incident or a regulatory obligation. With that I give an order of magnitude in the first conversation and a fixed proposal within a week. I do not sell blocks of hours against an undefined scope.
Start with the scope
A thirty-minute conversation is enough to determine whether the engagement makes sense, which type fits and what order of magnitude it carries. No cost, no commitment.