We break things professionally —
before attackers break your business.

An LLM-powered system that takes actions via tool-use (function calling) — a new class of attack surface for prompt injection.

Broken Object Level Authorization — an API flaw where an attacker can access objects they shouldn't by manipulating IDs. Also called IDOR.

A covert marker embedded in data or systems that alerts when triggered, detecting exfiltration or intrusion.

Cybersecurity & Infrastructure Security Agency Known Exploited Vulnerabilities catalog — flaws actively exploited in the wild.

Cyber Resilience Act — EU regulation mandating security-by-design, vulnerability reporting, and lifecycle obligations for products with digital elements (IoT/OT).

Common Vulnerabilities and Exposures — a standardized identifier for publicly disclosed security flaws.

Common Vulnerability Scoring System — a standardized 0–10 severity score for security vulnerabilities.

A hardware attack technique (voltage/clock glitching) that induces errors to bypass security checks or extract secrets.

Hardware Security Module — a tamper-resistant physical device for key management and cryptographic operations.

The international standard for industrial automation and control systems (IACS) security.

Health software security standard supporting FDA premarket cybersecurity documentation for medical devices.

The automotive cybersecurity engineering standard covering the full vehicle lifecycle.

A hardware debug interface (IEEE 1149.1) used for testing and debugging embedded devices — a common physical attack surface.

JSON Web Token — a compact, signed token for stateless authentication. Vulnerable to algorithm-confusion attacks if misconfigured.

A vulnerability where an API blindly accepts user-supplied object fields, allowing privilege escalation via hidden properties.

A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

A legacy unauthenticated protocol widely used in industrial control systems for PLC communication.

The NIST Cybersecurity Framework (2.0) — Govern, Identify, Protect, Detect, Respond, Recover functions.

The Open Worldwide Application Security Project's list of the ten most critical web application security risks.

An attack where malicious input manipulates an LLM into ignoring its instructions or leaking protected data.

Injecting malicious content into a retrieval-augmented generation knowledge base to influence LLM outputs.

Radio Equipment Directive — EU regulation requiring security features, SBOM, and vulnerability disclosure for wireless/connected devices.

Software Bill of Materials — a formal record of components and dependencies in a software product, required by RED/CRA and US Executive Order 14028.

A boot-chain verification mechanism that ensures only cryptographically signed firmware runs on a device.

Unsanctioned, unmonitored AI tools/endpoints used inside an organisation — a growing data-exfiltration surface.

An attack that extracts secrets from a device's physical characteristics (power, timing, EM emissions) rather than algorithmic flaws.

Server-Side Request Forgery — tricking a server into making requests to unintended destinations, e.g. cloud metadata endpoints.

Threat Analysis and Risk Assessment — the ISO 21434 methodology for evaluating automotive cybersecurity risk.

The IEC 62443 network-segmentation model: zones group assets by security level; conduits control traffic between them.