VoidSec is a small team of senior cybersecurity professionals with deep competitive capture-the-flag experience across web exploitation, cryptography, reverse engineering and binary exploitation. Competition rewards chaining small findings into real access, which is most of what client work turns out to be.
We do not publish individual profiles. You meet the people who will run your engagement on the scoping call, and they are the same people who write your report. If you need references, ask on that call: where a client has agreed to take the conversation, we will introduce you.
Four disciplines that overlap on most engagements. An odd response header turns into an exposure lead; a detail in how keys are handled turns into a path at the data behind them.
The application layer and the context around it: authenticated and multi-tenant paths, exposed infrastructure, forgotten subdomains, and the gap between what a company thinks is public and what is.
Cryptographic implementation and protocol review. Usually the primitive is sound and the way it was wired into the system is not.
Taking compiled software apart. Firmware, native clients, and anything where the source is unavailable and the behaviour still has to be established.
Cloud configuration, identity boundaries and network exposure, plus whether the logging in place could reconstruct an intrusion after the fact.
Client work stays confidential unless a client puts their name to it in writing, and competition results go up only with a public scoreboard behind them.
A scanner produces a hundred findings and no priorities. We report what chains into real access on your systems. We also say plainly when something scored high but goes nowhere.
Every finding arrives with the steps to trigger it. If your engineers cannot reproduce it in an afternoon, it is not finished work on our side.
Whoever is on the scoping call is testing your systems and writing your report. Nothing is handed to a junior once the contract is signed.
Bring a system you are worried about. What we ask about it in the first thirty minutes will tell you whether we know the territory.