SecLeapGmbH
§ Services

Six disciplines.
One senior team.

Six disciplines. Senior-led, no subcontractors. Each block: scope, deliverables, fit.

S · 01.0

Pentesting.

web · APIinternal networkcloudmobile

The bread and butter. A fixed-scope Starter Assessment for first engagements, full-scope tests for mature programs. Reports are reproducible. Fixes are engineering tasks, not vendor arguments.

Scope

  • Web & API: OWASP, business logic, auth flows
  • Internal network: AD, lateral movement, segmentation
  • Cloud: AWS / GCP / Azure posture & identity
  • Mobile: iOS & Android binary + traffic
  • Source-assisted when you give us the repo

Deliverables

  • Exec summary (1 page, no fluff)
  • Technical findings: PoC, payload, severity, fix
  • One re-test included within 90 days
  • Attestation letter for procurement / SOC 2
  • Editable findings doc: your team owns it

Three products

  • Starter · short engagement · one app, your external presence, or your Windows environment (on-prem or M365)
  • Full-scope · sized to your estate
  • Continuous · monthly retainer · with your release cycle
  • NDA & ROE signed before kickoff
  • CH-domiciled data, never leaves EU/CH unless asked
Priced on scope · Starter / Full-scope / Continuous Scope this engagement →
S · 01.5

Red teaming.

adversary simulationsocial engineeringpurple-team debrief

Pentesting asks "is this thing breakable?". Red teaming asks "can we achieve this objective?" Multi-vector, scoped against threat actors plausible for your industry.

Scope

  • Objective-based engagement (you write the flag)
  • Phishing & vishing campaigns, scoped & ethical
  • Physical & OSINT preface (optional, upon request)
  • Initial access through to objective: full kill chain
  • Threat-actor emulation: TTPs of named groups when relevant

Deliverables

  • Attack-narrative report: readable, with timeline & screenshots
  • Detection-gap appendix mapped to MITRE ATT&CK
  • Purple-team debrief: live walkthrough with your blue team
  • Evidence pack: payloads, C2 logs, indicators
  • 30-day follow-up to validate detections you've added

Good fit if…

  • You have an internal SOC and want to know what they catch
  • Pentests are clean but you don't trust that as the answer
  • You want a story your board will understand: "they got X in Y days"
  • An incident shook the company and you need an honest reset
Priced on scope · objective-based engagement Scope this engagement →
S · 02

Starter Assessment.

SMBscoped with youfixed quotere-test included

The entry point. We work out with you what actually matters, a senior tests it properly, and you get a fixed quote before anything starts. Built for companies that have never had a real security test, not a scaled-down enterprise engagement.

Scope

  • We define with you what matters most. That becomes the scope, and it does not move after
  • Ex: your external perimeter, what is reachable from the internet and how current it is
  • Ex: your Windows environment, Active Directory on-prem or M365
  • Ex: one web application or API the business runs on
  • Ex: remote access, the VPN and what sits behind it

Deliverables

  • Report your engineers can execute line by line. No filler
  • Every finding: what it is, how to reproduce it, how to fix it
  • Severity you can triage, not a wall of Medium
  • 30-minute walkthrough call with you and your team
  • One re-test within 90 days, included

Good fit if…

  • You have never had a real security test
  • A full-scope pentest is out of budget this year
  • An insurer, auditor or customer has started asking questions
  • You moved to M365 and nobody has checked the tenant
  • You want a number up front, not an open day rate
From CHF 2,500 · fixed quote before we start · re-test included Scope this engagement →
S · 03

AI Red Teaming.

LLM safetyprompt injectionagent control planesRAG

We attack the application layer around the model, not the weights. Bugs are real, fixes are engineering tasks, the report names them in your codebase. Aligned with the EU AI Act: Art. 15 (robustness & cybersecurity), Annex III risk classification, and the technical-documentation requirements you'll need to evidence.

Scope

  • Prompt-layer attacks: injection, jailbreaks, role confusion
  • RAG & tool poisoning, embedded payloads, schema leaks
  • Agent control plane: auth, tool ACLs, multi-agent collusion
  • Output handling: XSS via markdown, SSRF via tool-use
  • System-prompt & training-data leakage

Deliverables

  • Findings report with PoCs, payloads, severity
  • Code-level remediation, not "improve guardrails"
  • Re-test within 90 days, no extra fee
  • EU AI Act evidence pack (if you operate in scope)
  • Optional CI harness so regressions catch themselves

Good fit if…

  • Model in production, security team has questions
  • Agent in the loop: tools, browsing, writes
  • EU AI Act high-risk system, need external review
  • SOC 2 / ISO and the auditor asked about AI
  • Internal pentest team exists, AI muscle doesn't yet
Priced on scope · fixed quote before kickoff Scope this engagement →
S · 04

Blue team support.

SIEM tuningdetection engineeringcloud posturehardening

No license resale. We sit with your detection engineers, your platform team, your CISO, and make the alerts mean something. Roadmaps written with you, not at you.

Scope

  • SIEM rule audit & tuning (Splunk, Elastic, Sentinel, Panther)
  • Detection-gap analysis vs ATT&CK + your real attack surface
  • Cloud posture review (CSPM-style, but with humans)
  • Hardening playbooks for your specific stack
  • IR tabletop & live-fire drill design

Deliverables

  • Detection rules in your SIEM repo, ready to PR
  • Quantified gap report (what we'd catch, what we wouldn't)
  • Hardening checklist tied to your CI/CD
  • Tabletop facilitation + after-action notes
  • Knowledge transfer: your team can run it after we leave

Good fit if…

  • You have a SOC but the alerts are mostly noise
  • Cloud account count grew faster than your governance
  • Your last red team / pentest had findings you can't operationalise
  • New CISO needs an honest baseline before reporting up
  • You want detection content authored by people who write payloads
Priced on scope · sprint or retainer Scope this engagement →
S · 05

Consulting & training.

workshopssecure codingexec / board briefingstabletop

The same people who write the public tutorials run the in-person sessions. Hands-on, attacker-mindset, no slideware. Your engineers leave with payloads they wrote and a debugger they can drive.

Formats

  • Workshop · 1–3 days: small group, lab-driven, your code if you bring it
  • Secure-coding bootcamp · 1 week: language-specific (TS, Go, Python, Rust)
  • Exec / board briefing · 90 min: non-technical, scenario-grounded
  • Tabletop facilitation: IR & crisis comms drills
  • Custom curriculum: for security teams & AI safety teams

Deliverables

  • Lab environment your team keeps: runs on a laptop
  • Slide decks & lab handouts (editable, internal use)
  • Recorded sessions if requested (your storage)
  • Skill-baseline + post-session assessment
  • Reading list curated to your stack & threat model

Topics that actually move

  • "How an attacker reads your codebase": code-review for engineers
  • "Prompt injection from first principles": for AI eng teams
  • "Building detections that catch real things"
  • "Auth flows in 2026": OAuth, OIDC, passkeys, magic links
  • "Web for hackers": the adversarial mental model
Priced per session · workshop or briefing Book a session →
S · 06

Research & publishing.

papersdisclosuresopen-source toolingnot a revenue line

This is not a service we sell. It's how the hands stay sharp and the rest of the catalogue stays credible. Listed here so you can see how clients occasionally touch the work.

What we publish

  • Tutorials & long-form write-ups on Learn (coming soon)
  • Free-to-use tools, small and focused

Where clients fit

  • Disclosure handling: we'll coordinate a CVE found during your engagement
  • Sponsored research: pre-publication NDA, joint authorship
  • Tool customisation: internal forks of our open-source for your stack
  • Credit appears in our annual report unless you opt out

Why it matters

  • Hiring filter: the people who do this work attract more like them
  • Honesty signal: public work is the easiest way to verify a vendor
  • Skill maintenance: research keeps client work non-mechanical
  • Industry contribution: we benefit from the commons; we pay back into it
Read what we've published →
§ HOW WE WORK

Five steps. No phase 0.

From first call to delivered report
01 · Scope

20-minute call

One of the senior team. We listen, ask, and decide together if we're a fit. No SDRs, no "discovery deck."

~20 min
02 · Proposal

Fixed scope

Written proposal: scope, methodology, named lead engineer, agreed dates. Within 3 working days.

3 days
03 · Test

Where the work happens

Daily standup with your security lead. Live findings shared as we go. No surprises in the report.

duration scoped per engagement
04 · Report

Editable, reproducible

Exec summary & technical findings. PoCs, severity, code-level fixes. Editable doc, your team owns it.

~short engagement
05 · Re-test

Within 90 days

Fixes verified. Updated report. No extra fee, included in the original engagement.

included
§ FAQ

Things clients ask before kickoff.

NDA · MSA

Yes to both. We sign yours or send ours, whichever is faster. Mutual, Swiss-law, with a carve-out for sanitised techniques (not findings) appearing in our research. Standard MSA + per-engagement SOW.

Data residency

Engagement data lives in CH or EU at your choice. We'll sign a DPA. Reports never leave that region without written consent. We don't use third-party AI services on client data unless you've explicitly approved the provider.

Scheduling

Typical lead time is a few weeks. Emergencies (suspected compromise, pre-launch panic) we slot within a week, scope reflects the displacement, no theatre about it.

Report formats

Editable HTML (our generator: you can edit findings, severity, copy in the browser), PDF, and DOCX. We give you the source. You own the document. We retain a redacted copy for the legally-required period and nothing else.

Re-test policy

Included on every Pentest, AI red team, and Red team engagement: one re-test of fixed findings within 90 days. No extra invoice. After that, retests are a standard daily rate.

Subcontractors

None. The team you meet on the scoping call is the team that does the work. If we ever can't deliver a piece in-house we tell you up front and you get to choose whether to bring in a partner or wait. We do not white-label other firms.

References

On request, with the client's permission. Most of our work is NDA-bound, so the public proof is what's on Learn: read a tutorial, read a CVE write-up, decide from that. If you need named references we will introduce you to past clients in your industry.

§ Next step

Scope an engagement.

20 minutes with one of the senior team. No deck, no SDR. We hang up with either a fixed-scope proposal coming, or an honest "we're not the right fit."

Open contact form
§ Or first

Read what we've written.

Tutorials, CVE write-ups, research notes, open-source tools. Half our surface is public; vetting us starts there.

Open Learn