Offensive & product security
For software and device manufacturers. Web, API and mobile applications tested personally by an expert with 15 years of experience – from scoping to retest.
Experience gained in security teams at: F-Secure · Egnyte · Lufthansa Systems · Autopay · Include Security · 7ASecurity
Services
Offence shows where the gaps are. Defence keeps them from coming back. I work on both sides and connect them into one consistent process.
Offensive security
We break. So they can’t.
Controlled attacks on your applications and infrastructure – with a report that both your board and your developers can act on.
Defensive security
We fortify. So they can’t get in.
Processes and practices that keep a product secure from design through every release – and compliant with regulation.
Getting started
Fixed scope and fixed price, agreed before we start. No hourly billing, no surprises on the invoice.
For manufacturers of software and devices with digital elements.
OutcomeGap report against CRA requirements and an implementation plan
Web application, API or mobile app – scoped to its size.
OutcomeReport, walkthrough with your team and retest
For consultancies and software houses that need an experienced penetration tester.
OutcomeSenior capacity without a full-time hire
I prepare a quote within one business day of our scoping call.
What you get
Not scanner output – verified vulnerabilities with business context and concrete remediation guidance.
Penetration test report
Confidential| Finding | Risk | CVSS | Status |
|---|---|---|---|
| Broken object-level authorisation in API (IDOR) | Critical | 9.1 | Fixed |
| Stored XSS in admin panel | High | 8.0 | Fixed |
| No login attempt rate limiting | Medium | 5.3 | In progress |
| Incomplete HTTP security headers | Low | 3.1 | Fixed |
Public audits
Since 2021 I have worked as a consultant with 7ASecurity – a firm that audits open-source projects and privacy tools, often commissioned by organisations such as OSTIF and the Open Technology Fund.
Some reports from audits I took part in have been published with the maintainers’ consent. They show how I document vulnerabilities and recommendations.
Reports on the 7ASecurity websiteTypical audit scope
The same set of activities the Cyber Resilience Act expects from manufacturers.
Process
Clear rules from the first call. No test starts without written authorisation and a clearly defined scope.
A free 30-minute consultation. We agree on goals, scope and a fixed price.
Contract, NDA, written test authorisation, test window and emergency contacts.
Critical issues are reported immediately, not held for the final report.
Results presented to your team, then fixes verified.
Methodology based on:
About
For 15 years I have worked in security: penetration testing of web and mobile applications, host and cloud configuration reviews, and since 2020 product security across the entire software development lifecycle.
Before that I spent 10 years administering Linux and AIX systems and 2 years running networks. That is why I test real environments, not just a scanner checklist – and why I know which recommendations can actually be implemented in a real company.
At F-Secure I led the global ASV team, ran ASV scans and PCI DSS penetration tests, and onboarded new consultants. I then built application security inside product teams at Egnyte, Lufthansa Systems and Autopay. From 2021 to 2025 I worked with Include Security as a Senior Penetration Tester, and since 2021, as a consultant with 7ASecurity, I have taken part in audits of open-source projects. After hours, I hunt for vulnerabilities in bug bounty programmes.
I have run my practice under the sysBreakers name since 2020.
Regulation
Security testing and processes are now a legal obligation – for you and for your customers.
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities. Full requirements apply from 11 December 2027.
Essential and important entities must manage cyber risk, test their controls regularly and require the same from suppliers.
Digital operational resilience testing in financial services and payment card data security.
FAQ
Risk is limited contractually: an agreed test window, no load or denial-of-service testing, and emergency contacts on both sides. Where possible, I test on a staging environment that mirrors production.
It depends on scope – a typical application test takes from a few to a dozen or so business days. The report deadline is agreed in the contract, and critical findings are reported as soon as they are confirmed.
Yes, before any technical details are discussed. Test data is stored encrypted and deleted as agreed in the contract.
A B2B contract and an invoice. The price is fixed for the agreed scope – no hourly billing.
Yes. I work remotely with clients across the EU, and reports are available in English or Polish.
Contact
Briefly describe what you want tested or prepared. I reply within one business day.
Thank you for reporting responsibly. Rules and contact details are in security.txt.