Independent penetration testing
EnfroSec is an offensive security firm. Our senior testers bring decades of combined experience, 100+ penetration tests, and original vulnerability research to every engagement. You work directly with the people doing the testing, from kickoff to retest. Fixed scope, fixed fee, findings written to be fixed.
Services
Scanners find the easy stuff. The findings that matter come from chaining weaknesses the way a real attacker would. Every service below is manual-first, scoped to your environment, and priced as a fixed fee.
What an attacker on the internet can reach and break: exposed services, VPN and mail gateways, cloud edge, leaked credentials, known-exploit validation.
Assumed-breach from a workstation or VPN foothold. Maps the path from one compromised user to Domain Admin and the data you actually care about.
Authenticated, multi-role testing that goes past the OWASP Top 10 into access control, business logic, and the workflows scanners cannot understand.
REST and GraphQL tested for broken object and function level authorization, token handling, and introspection leaks. Author of jwtmap and checkQL.
iOS and Android apps tested on device and against their backend APIs. Author of mavs, a mobile application vulnerability scanner.
Chatbots, copilots, and agents carry a new attack surface. Tested by someone who did AI security research professionally before it was a product category.
Phishing, vishing, and pretext campaigns that measure how your people and processes respond, with a debrief that builds awareness instead of blame.
On-site testing of corporate and guest wireless: rogue access points, WPA-Enterprise weaknesses, and whether guest Wi-Fi really is isolated from corporate.
AWS, Azure, and GCP reviewed for the misconfigurations that turn one leaked key into a full account compromise.
Does customer data flow the way your privacy policy says it does? Adversarial testing of data handling, access paths, and exfiltration routes, informed by leading privacy red team work at TikTok.
Reports and attestation letters that map to PCI DSS, SOC 2, HIPAA, and cyber insurance questionnaires. Scoped so your auditor gets what they need.
Fixed something and need proof? Standalone retests of a prior report, yours or another firm's, with an updated attestation.
Senior subcontract capacity for consultancies and MSSPs. White-label delivery under your templates, your NDA, your rules of engagement.
Process
No surprises on price, no surprises during testing, no report that sits in a drawer.
A free 30-minute call and a short questionnaire. Fixed-fee quote and written rules of engagement within two business days.
Manual-first testing against the agreed scope. Daily status. Critical findings reported the day they are confirmed, not at the end.
Executive summary, an attack storyboard showing how findings chain, and per-finding CVSS, reproduction steps, and fixes. Delivered with a live debrief.
Fix it, then prove it. A remediation retest is included, with an updated report and an attestation letter for auditors, customers, or insurers.
Why EnfroSec
A senior tester scopes, tests, writes, and debriefs your engagement. No handing you off to a junior after the sales call.
Our team's background spans enterprise security consulting at Rapid7 and platform red teaming, testing Fortune 500s, banks, hospitals, and government agencies.
Published CVEs, contributions to Metasploit, Evilginx2, and Serpico, and 45+ open source security tools used by other testers.
Every finding has a severity, a reproduction, and a fix. The attack storyboard shows engineers how the pieces chain so they prioritize the right thing.
Written rules of engagement, testing windows you control, no denial-of-service, and a direct line to the tester for the whole engagement.
Scoped once, priced once. No hourly meter and no change orders unless you add scope.
Deliverables
Two pages leadership will actually read: overall risk, what was reached, what to fund first.
The engagement narrative, step by step, showing how individual findings chained into real impact.
CVSS score, affected assets, evidence, reproduction steps, and specific remediation guidance.
A walkthrough with your engineering and security teams before anyone starts fixing.
Verification that fixes worked, with an updated report showing closed and open items.
A summary letter suitable for customers, auditors, and cyber insurance carriers.
Tools
Our team authors open-source security tools used by testers worldwide. The same research that finds published CVEs sharpens every engagement. A selection is below; the full set lives on GitHub.
Maps JSON Web Token weaknesses, like SQLMap for JWTs.
Finds GraphQL endpoints and tests for introspection exposure.
Mobile application vulnerability scanner for iOS and Android.
CVE-2025-55182 toolkit: scanner, Nuclei templates, and a lab.
CVE-2025-14847 scanner for an unauthenticated MongoDB memory leak.
Nmap scripts for detecting SIGRed and SMBGhost exposure.
Analyzes NTDS hashes and password reuse from AD dumps.
Enumerates and mounts readable network shares on a target.
Extracts operator logs for clean, reportable red team records.
Writing
Field notes from real engagements and vulnerability research. Published on our founder's site; the latest are below.
Loading latest posts…
FAQ
Most engagements run one to three weeks of testing plus about a week for reporting. A single web app or a small external perimeter sits at the short end. Internal network and multi-app scopes run longer. The scoping call pins down the timeline.
Every engagement is a fixed fee based on scope: hosts, applications, user roles, and testing types. You get a written quote within two business days of the scoping call, and the price does not change unless you add scope.
Rules of engagement are agreed before testing starts: what is in scope, when testing can happen, what is off limits, and how to pause. No denial-of-service testing is performed. Anything with potential for disruption is coordinated with you first.
For network tests, usually yes, with safeguards. For applications, a staging environment that mirrors production with realistic data is preferred, but production testing is done regularly when that is the only option.
Yes. Reports are structured so auditors can map findings to requirements, and an attestation letter is included. Tell us which framework you are working toward and the engagement will be shaped to it.
A senior tester, not a junior bench. The person who scopes your engagement is the one who tests it, writes the report, and walks you through it. EnfroSec was founded by Leon Johnson, a tester with 20+ years in offensive security, and brings in vetted senior specialists as scope requires.
Yes. EnfroSec provides senior overflow capacity for consultancies and MSSPs under NDA, delivered white-label in your report template if needed.
Yes, before any scoping details or data are shared. Yours or ours.
Get started
Thirty minutes to understand your environment, your goals, and any compliance deadlines. You leave with a fixed-fee quote on the way. No one pays before a conversation.
or email info@enfrosec.com