From serialised bytes to shell: exploiting Java deserialisation
Case study from an authorised pentest: Remote Code Execution via insecure Java deserialisation in Spring HttpInvoker.
Read → Smarter
Gândim ca atacatorul, nu ca scannerul
Fiecare constatare e găsită și verificată manual, cu lanț de exploatare demonstrat. Un scanner îți spune ce versiune rulezi. Noi îți arătăm ce se poate face cu ea.
Better
Severități în care poți avea încredere
Nu inflăm criticalitatea ca să pară raportul mai valoros. Primești o listă scurtă de lucruri care contează — și pe care echipa ta le poate închide.
Certified
Firmă certificată, echipă certificată
ISO 27001:2023 și ISO 9001:2023 la nivel de companie. OSCP, OSWP, CEH, LPT, CISA și GICSP la nivel de echipă. Rapoarte bilingve.
Penetration testing
Knowing your vulnerabilities isn’t enough. You need to know what an attacker can do with them.
A well-executed penetration test correlates vulnerabilities, configurations and access rights into a realistic attack scenario. The result shows which assets are exposed, which controls work and where intervention is most urgent.
- Exploitable vulnerabilities, manually validated
- Attack chains and pivot points
- Architecture and segmentation flaws
- Detection and response capability
- Real exposure of data and systems
- Evidence for audit and compliance
- Clear remediation priorities
- Validation of security investments
Capabilities
The attack surface no longer stops at web apps and networks
Cloud, industrial systems, digital identity, AI models and software supply chains have radically expanded the attack surface. Our capabilities cover these environments without sacrificing the rigour of traditional testing.
01
ICS / SCADA / OT
We assess industrial control systems in energy, water, district heating and manufacturing. Testing is planned to limit operational risk and uses protocols and scenarios specific to industrial environments.
02
Cloud, Kubernetes and IaC
We assess public, private and government cloud, Kubernetes configurations, containers, IAM policies, pipeline secrets and the gap between infrastructure declared in code and what actually runs in production.
03
Red Team and TIBER-EU
We build offensive scenarios from relevant threats and explicit business objectives. Exercises can be aligned with the TIBER-EU framework, national implementations and DORA operational resilience requirements.
04
AI-assisted pentesting
We pentest with our own AI platform — a frontier or self-hosted LLM, plus a proprietary methodology with iteration loops, strict safety instructions and an interactive-pentester mode. The tools cut dead time; judgement and control stay with the tester.
05
AI and LLM system security
We test prompt injection, data exposure through context, tool-equipped agent abuse, insufficient isolation and escalation through model integrations. The assessment tracks risks introduced when an AI system gets access to real data and processes.
06
Hardware, embedded and firmware
We analyse embedded devices, firmware, hardware interfaces and communication protocols, including black-box scenarios and controlled physical access conditions.
07
eKYC and deepfake resilience
We assess identity verification flows against synthetic presentations: generated images and video, manipulated documents, cloned voice, replay and liveness bypass. Testing is relevant for banking onboarding, fintech and payment institutions.
08
Purple teaming and detection validation
We execute attack techniques alongside the defence team and measure what the SOC, EDR and correlation rules detect, what goes unseen and how long the response takes. The result is a concrete plan for improving detection.
Ce ne recomandă
Muncă serioasă, făcută din pasiune, cu respect pentru nevoile clientului
-
Experiență
Ne-am format expertiza în proiecte complexe de securitate: cercetare, învățare și predare. De la retail la apărare națională, de la proiecte caritabile la ICS/SCADA — suntem prezenți într-o piață în continuă schimbare de peste 15 ani.
-
Pasiune pentru securitate
Ne place ce facem. Învățăm continuu, pe măsură ce apar tehnologii noi, și intrăm în fiecare proiect cu ambiția de a livra aceeași calitate fiecărui client.
-
Înțelegem afacerea
Indiferent de industrie, știm că ești mândru de ce ai construit. Vrei să fie în siguranță și vrei să crească. Nu suntem doar experți tehnici — croim securitatea pe forma afacerii tale.
ISO/IEC 27001:2023Information security
ISO 9001:2023Quality management
Services
Services built around real risk
From one-off assessments to multi-year programmes, we define scope, depth and reporting based on critical systems, relevant threats and compliance requirements.
Web and API testing
Web applications, REST and GraphQL APIs, API-first architectures and B2B integrations. Manual testing focused on application logic, authorisation and data impact.
Details →Infrastructure testing
External perimeter, internal network, Active Directory, sensitive segments and wireless networks. We identify access paths, escalation and lateral movement.
Details →Mobile application testing
iOS and Android applications, including mobile banking, authentication mechanisms and RASP protections. We analyse the app, communications and associated APIs; retesting is included.
Details →Compliance audit
Assessments against national authority and financial supervisor requirements, as well as frameworks and standards such as NIST CSF, ISO 27001, PCI DSS, NIS2 and DORA.
Details →Industrial security (ICS/SCADA)
Security assessments for industrial systems, networks and protocols, planned around safety, availability and process continuity requirements.
Details →CISO-as-a-Service and GRC
Governance, risk analysis, policies, compliance programmes and security coordination for organisations that don’t need or don’t yet have a full-time in-house CISO.
Details → Sectors
We work where downtime has real consequences
Every sector has different technologies, threats, obligations and risk tolerances. The methodology stays rigorous, but the scenarios and evaluation criteria are adapted to the operational context.
Banking and financial
Commercial banks, credit institutions, fintech, payment institutions and processors, in heavily regulated contexts with strict resilience requirements.
Energy
Generation, transmission and distribution, hydropower, district heating and supply, with interdependent IT and OT infrastructures.
Utilities
Water and sewage operators, where IT infrastructure, communications systems and the SCADA environment must be assessed together.
Nuclear and industrial
Organisations in nuclear, oil and gas and continuous-process manufacturing, where safety and availability take priority.
Healthcare and pharma
Pharmaceutical manufacturers, medical institutes and organisations managing sensitive data, laboratory systems and connected equipment.
Public sector
Central and local authorities, digitalisation agencies and publicly funded projects, with high requirements for transparency, continuity and compliance.
Relevant experience
Projects we can describe without breaching confidentiality
Most projects are protected by non-disclosure agreements. The examples below are anonymised but preserve the type of organisation, the scale and the nature of the work.
Multi-year programme
Multi-year penetration testing and security audit programme for one of the largest banking institutions in Romania.
Central bank
External, internal, interbank and wireless testing, complemented by vulnerability assessments, for a state’s central bank.
Mobile banking
PCI DSS v4.0.1 audit for a payment application, with documentation accepted by the banking regulator.
International programme
Security audits and penetration tests for seven energy and critical-infrastructure companies, within a programme coordinated by an international development organisation.
Government cloud
Security assessment for application migration to a government private cloud, carried out under a framework agreement funded through the NRRP.
Nuclear and oil & gas
Penetration tests for organisations in the nuclear sector and the oil and gas industry.
Early Access · Vigilum by SafeByte
Expose the attacker before the attacker exposes you.
Vigilum deploys credible decoy artefacts across your infrastructure — credentials, sessions, files, services and cloud keys — that no legitimate user or process has a reason to touch.
When one of these artefacts is accessed, you get an early, context-rich signal: the source of the activity, the pivot points and the path taken through the infrastructure.
- High-confidence signals with no dependency on continuous tuning
- Visibility into lateral movement and the attack path
- On-premises or fully air-gapped deployment
- Complements your EDR and SIEM — doesn’t replace them
Blog
Analysis and field observations
Technical articles, project lessons and explanations of risks worth understanding. No marketing noise.
Post-quantum cryptography: implications for banks and critical infrastructure
NIST PQC standards, the Harvest Now Decrypt Later threat and a migration framework for the financial and energy sectors.
Read →
Study — Artificial Intelligence in Cybersecurity
Strategic study: from DARPA AIxCC results to risks for Romania and short-, medium- and long-term recommendations.
Read → Contact
Tell us what needs to be assessed
Briefly describe the system, objective and estimated timeline. We’ll get back to you within one business day. For sensitive information, you can use our PGP key.
- office@safebyte.io
- Vulnerability reporting
- security.txt · PGP key available
- Office
- Bucharest, Romania
SafeByte Consulting S.R.L.