Real security for industries where money matters.

High-value iGaming operator

Bet values editable through the API.

Penetration testing found IDOR and authorisation flaws that let a player change bet values. Fixed and verified before anyone exploited them.

Land-based casino group

Ransomware on vendor-managed gaming servers.

ESXi hosts behind the gaming floor were encrypted. We ran forensics, contained it with the gaming vendors, restored operations and hardened the estate.

Multi-provider online casino

Game-provider callbacks that could pay twice.

We tested aggregator, RGS and wallet callbacks for replay and duplicate credits, then locked down signing and idempotency.

TopOne Trader

Agentic shopping-cart takeover, stopped in 2 hours.

An attacker hijacked the AI agent behind the checkout cart. We cut its tool scope, blocked the session and put runtime guardrails in place.

National telco wallet

Hybrid online-offline wallet, live since 2015.

Micro-transaction wallet with a national telco, later deployed in the UAE.

Cloud tenant takeover

Tenant takeover contained, with Randy Garn.

Stopped a takeover of a cloud tenant and rebuilt access controls.

Read the study ↗

RMI

Audit evidence on autopilot.

Security architecture, audit evidence and 24/7 monitoring for regulated operations.

Read the study ↗

Spixi

Post-quantum messenger and wallet.

Quantum-safe peer-to-peer chat and payments on the Ixian DLT. No phone number, no central server.

Spixi ↗

Rage Effect

Cross-play shooter with a live token economy.

Security for a Web3 AAA shooter with $RGE, NFT staking and player economies across mobile, PC and PS5.

Read the full story →

ComplexCon

Tickets, drops and access in one app.

Ticketing, QR entry and marketplace access for ComplexCon Hong Kong.

Complex app ↗

EKWB

Checkout that holds at peak.

Bot and fraud defence for a global PC-cooling brand selling direct.

Read the study ↗

Zebra BI

Enterprise-ready security, fast.

Security and compliance for reporting visuals used by enterprise finance teams.

Read the study ↗

Remote-medicine provider

24/7 security in high-risk regions.

Managed security and certification for a global remote-medicine provider.