About
TOWERVECTOR
Independent security research and consulting for organizations that build and run critical systems.
Position
TowerVector works from one position: an organization defends what it understands, and understanding a system means seeing how it breaks.
We test the way an attacker would, then stay long enough to help fix what we find.
Overview
What we do
We test systems the way attackers do, help the engineers and IT administrators who own them fix what we find, and put in place the controls that keep it fixed.
The work spans three practices: offensive security, security engineering, and consulting. The question behind most engagements is how a system fails, before an attacker demonstrates it.
Expertise
Certifications held
Five years of hands-on work across offensive security, application testing, and infrastructure, in environments ranging from a single product to estates spanning cloud and on-premises data centers.
Each certification below is verifiable directly with the body that issued it.
- OSCP Certified Professional OffSec
- OSEP Experienced Penetration Tester OffSec
- OSWE Web Expert OffSec
- CRTL Certified Red Team Lead Zero-Point Security
- CRTO Certified Red Team Operator Zero-Point Security
- CDP Certified DevSecOps Professional Practical DevSecOps
Research
We publish our research
We publish our R&D, including research on new techniques, and advisories for vulnerabilities we report to vendors.
Vendor findings go through coordinated disclosure. We agree a timeline, give the vendor room to release a patch, and publish afterwards with the detail an affected organization needs to tell whether it is exposed or not.
You can find our PGP key and security contact at security.txt.
How we work
Evidence, then remediation
Three things hold across every engagement, whatever the scope.
Attacker mindset
Test systems the way attackers do
Manual, objective-driven testing against the systems you run, with every finding reproduced and evidenced.
Engineering depth
We help fix your findings
Findings come with the detail your engineers and administrators need, and we stay involved through remediation and re-testing.
Governance
Controls that survive testing
Frameworks turned into technical controls, prioritized by what reduces real risk first.
Contact
Tell us what you need
Describe the systems and what you need looked at. We come back with a scope and a window before you commit to anything.
- [email protected]