The Style Attribute Is Your Sanitizer's Blind Spot
A field guide to finding CSS-based page hijacks in HTML sanitizers.
Penetration Testing for Real-World Risk
Offensive Mindset. Defensive Solutions.
Penetration testing that finds what automated scans miss across web applications, cloud environments, internal networks, and identity systems.
Security assessments built around your real risk
Focused engagements that show where your organization is exposed, what matters most, and how to fix it.
Network Pentesting
Test the paths an attacker could use to reach your network, identity systems, and critical internal assets.
Best for: Internal networks, remote access, and identity infrastructure.
Web App Pentesting
Uncover business-logic flaws, hidden API risk, and application weaknesses that automated testing often misses.
Best for: Customer-facing applications, portals, and APIs.
Cloud Pentesting
Validate cloud identity, configuration, and workload controls before a small gap becomes broad access.
Best for: AWS, Azure, and GCP environments.
Consulting
Turn technical risk into an actionable security roadmap for leadership, engineering, and operations.
Best for: Security decisions, program direction, and readiness.
Not sure which assessment fits? Request an Assessment Plan →
AI Threats
AI Doesn’t Need a Zero-Day.
It just needs the weakness you haven’t found yet.
AI isn’t rewriting the fundamentals of offensive security. Attackers are still looking for the same things: exposed services, broken access controls, weak authentication, vulnerable applications, forgotten assets, and assumptions that were never tested.
What’s changing is how quickly they can find them.
AI can accelerate reconnaissance, analyze applications and APIs, correlate information across systems, adapt tooling, and help identify promising attack paths with less manual effort.
The vulnerabilities haven’t changed. The speed has.
AI doesn’t need to invent a sophisticated new exploit. Sometimes it just needs to notice what everyone else missed.
That’s why offensive security matters.
Test the application. Test the assumptions. Find the weakness first.
Traditional attacker
More time between stages
Recon
Discovery
Analysis
Exploitation
Impact
AI-assisted attacker
AI compresses the work between stages
Recon
Discovery
Analysis
Exploitation
Impact
The stages don’t change. The time and effort required to move between them can.
About Us
Senior security practitioners who bring an attacker's curiosity and a defender's responsibility to every engagement.
Josh "j3tj3rk"
Co-Founder & Principal Security ConsultantJosh (“j3tj3rk”) transitioned from law to technology over a decade ago, starting on a small MSP help desk before discovering his passion for offensive security. He has spent the last 7 years consulting for Fortune 500 companies in roles including Network Pentester, Web App Consultant, and Red Team Lead. Josh's team won the 2022 WWHF CTF, and his expertise is backed by Security+, eJPT, CRT, and CISSP certifications. Outside of work, he enjoys hiking, surfing, and eating Al Pastor tacos in Southern California, where he lives, with his wife and their dog, Bruce Wayne.
Nic "Sav4j"
Co-Founder & Principal Security ConsultantNic (“Sav4j”) got his start in technology seven years ago in general IT for the educational system, where he discovered his passion for offensive security. What began as curiosity quickly became an obsession with understanding how systems work, how they fail, and how they can be secured. He spent several years as a Red Team Operator before transitioning into an Offensive Security Engineer role at a SaaS company, with particular interests in web application security, reverse engineering, malware analysis, and binary exploitation. Before entering technology, Nic spent a decade in the United States Navy as a Corpsman and later several years as a police officer. Across each of his careers, he has been driven by a desire to help others, a mindset he now brings to cybersecurity. Outside of work, Nic enjoys reading, camping, and fishing with his two dogs.
Latest Security Research
Independent research that shows how we investigate real attack paths and why the findings matter to defenders.
Filenames Are Data Too: A Blind Spot in Removable-Media Telemetry
How zero-byte file creations can bypass content-focused removable-media telemetry.
A Public Form with Three Vulnerabilities in One UI
CAPTCHA bypass, phishing relay, and blind SSRF from one unauthenticated endpoint.
An IDOR in a Portal's Logo Endpoint Was Actually an Any-File Leak
How an unauthenticated file-serving endpoint exposed candidate documents.
Architectural Risk & Remediation: Deconstructing the OWASP Top 10 (2025 Edition)
A technical breakdown of the architectural risks behind the current OWASP Top 10.
Two Instances, One Platform, the Same Broken Authorization Pattern
Systemic architectural vulnerabilities in multi-tenant SaaS deployments.
The Filter is Only in the UI: An Internal Pentest of a PM SaaS
How client-side filtering and missing server-side auth checks allowed a standard account to harvest org-wide data.
Five Hops and a Live Operator
How a multi-hop redirect chain, automated scanner evasion, and a live operator combined to harvest card data and PII
The Client Was Retired, Its Attack Surface Wasnt
How a retired mobile app exposed live API routes, enabled cross-tenant enumeration, and revealed a major gap in incident-response telemetry.
What you get with Bulkhead
Security work designed to help people make decisions, not just satisfy a checkbox.
Evidence you can act on
We verify findings manually and explain the realistic impact, so your team can focus on the issues that deserve attention.
A clear path to remediation
Prioritized, developer-friendly guidance gives your team a useful path forward after the assessment.
Testing that reflects real attackers
We follow the routes a capable attacker would explore, including identity, business logic, cloud, and trust boundaries.
What an engagement looks like
A straightforward process that gives leaders clarity and gives technical teams a useful path forward.
01
Scope the risk
We start with your priorities, environment, and concerns to define a focused engagement that fits the decision you need to make.
02
Test and verify
We combine automation with hands-on validation to distinguish meaningful exposure from noise and false positives.
03
Prioritize and improve
We walk through the results with your team and align on the next steps.
Define the right assessment for your environment.
Tell us about your environment and the decision in front of you. We’ll help identify the appropriate assessment scope.
Request an Assessment PlanPrefer to email us directly? info@bulkheadsec.com
Trusted when the details matter
Feedback from security leaders who needed more than a compliance checklist.
"Bulkhead Security exceeded our expectations throughout the entire assessment. Their attention to detail and depth of subject-matter expertise were evident at every stage. They went far beyond automated scanning, thoroughly investigating our application’s workflows and identifying risks in the context of how the platform actually operates. What impressed me most was their ability to translate highly technical findings into clear business risks and practical, actionable recommendations. Their final report gave our development team a prioritized roadmap for strengthening the application, while giving me confidence that we understood what mattered most and why. Bulkhead is an exceptional partner for any organization looking for a rigorous, thoughtful, and business-focused security assessment. I would recommend them without hesitation."
"Bulkhead Security uncovered structural flaws within our Active Directory deployment that previous compliance-driven audits missed entirely."
"Their Web App Penetration Testing team provided exceptional business-logic exploitation analysis prior to our core enterprise platform launch."