Live threat feed
Updated hourly RSS Full feed →

Loading newest threat feed items…

Founder on every test
OSCP+ and GWAPT
U.S. Veteran Owned
Hiscox professional liability
Cleveland, OH
VETERAN
OSCP+
GWAPT
INSURED
SQUID SquidSec logo SEC

Penetration testing that proves the risk, then proves it is fixed

Manual, adversary-led testing of the web apps, APIs, cloud, Microsoft 365, AI, and .NET desktop software you ship. You get the attack chain, the business impact, and a retest letter after your team closes it.

How an engagement works

Reply within 24 hours. Scope, timeline, and price. No pitch deck.

squidoffense.com
Cleveland, OH

Why teams call us

A customer is asking for proof

Security questionnaires, enterprise procurement, and SOC 2 evidence all go faster with an independent test and a retest letter.

You are shipping something new

A new product, API, tenant migration, or AI feature before customers depend on it. Test the design while changes are still cheap.

A deal or audit is on the line

M&A diligence, cyber insurance renewal, PCI or HIPAA readiness, or a board that wants an outside answer on exposure.

A scanner report is not enough

Your team already runs tooling. You need a person to chain the findings into the incident an attacker would actually run.

What SquidSec tests

Founder-led testing across the stack you actually ship.

Network

External and internal. Breach data and leaked creds first, then Active Directory paths from a normal user to Domain Admin.

ExternalInternal ADDomain takeover

Applications and APIs

Every role, not one admin login. BOLA, IDOR, privilege jumps, and workflow abuse a scanner will not prove.

WebAPIBusiness logic

Cloud and Microsoft 365

Identity-first, because tenant takeovers rarely start with a missing patch. Entra ID, Conditional Access, token theft, app consent.

Entra IDM365AWS / GCP

AI and LLM

How your copilot or agent is actually built. Prompt injection, retrieval abuse, data leaving the system, unintended tool calls.

Prompt injectionRAGAgents

Windows thick clients

.NET, WPF, and UWP. How the desktop client trusts its backend, and what a user on the box can reach.

.NETWPFLocal privilege

Android

Static and runtime testing of the app and the API behind it. Storage, memory, network, and stolen-device risk.

StaticRuntimeReverse engineering

Supply chain

Libraries, build pipelines, MSPs, and update channels. The code and access you already trust, mapped as an attack path.

DependenciesCI/CDMSPs

Hardening

Linux and Windows baselines against how the box is really used. What is exposed, what is default, what a foothold turns into.

LinuxWindowsBaselines

How an engagement works

Same person from the scoping call through the retest.

  1. 01. Scope

    Targets, accounts, environments, and what is out of bounds. You approve it before testing starts.

  2. 02. Rules

    Written rules of engagement: hours, emergency contact, and what gets exploited versus proven and stopped.

  3. 03. Timeline

    A start date and a report date on the scoping call. Typical web or thick-client tests run one to two weeks.

  4. 04. Report

    Executive summary for leadership. Technical findings with reproduction steps and business impact for engineering.

  5. 05. Retest

    Fixed findings are retested. You get a short letter you can hand to a customer or auditor.

Why buyers pick SquidSec

A specialist, not a catalog.

01. Founder-led

The person on the scoping call does the testing and writes the report. No junior bench, no offshore handoff, no rotating cast.

02. Builder background

13+ years of .NET and full-stack engineering. Fixes are written so a developer can ship them, not so a slide deck looks complete.

03. Proof, not noise

Tools map the target. The report is what was exploited, how far it goes, and what it costs the business if it is left open.

What you actually receive

Written for the two audiences that have to act on it: leadership and the engineers doing the work.

Questions buyers ask

Is this a scanner report?

No. Tools are used to map the target. The assessment is the manual work after that: business logic, authentication, and attack chains a scanner will not prove.

Who does the work?

The founder. U.S. veteran, Cleveland, OH. OSCP+ and GWAPT. Professional liability insurance through Hiscox.

What is in the report?

An executive summary, prioritized technical findings with reproduction steps where it is safe to include them, and a retest letter after fixes land.

Can you cover more than one target?

Yes. Network, application, cloud, AI, thick client, Android, supply chain, and hardening can be scoped together or separately. You get a clear yes or no before a contract.

How long does an assessment take?

Most web, API, and thick-client tests run one to two weeks of testing. You get a start date and a report date on the scoping call, before anything is signed.

Will you sign an NDA and work under our rules?

Yes. NDA, written rules of engagement, testing hours, and an emergency contact are agreed before testing starts. Exploitation stops at proof unless you ask for more.

Book a scoping call

Tell us the app, the API, or the thick client. You get a scope, a timeline, and a price. No capabilities deck.

A 30-minute call is usually enough to tell you whether a full assessment is worth your budget, and what it would cover.

contact@squidhacker.com
Cleveland, Ohio. Working with teams across the U.S.
NDA available before you share anything sensitive.
Or email us directly

Cleveland, OH. U.S. Veteran Owned. Hiscox insured.

Request a scoping call

Four fields. We reply within one business day.

Used only to reply to your request. Nothing is shared or added to a mailing list.