Findings go out the hour we confirm them
Nothing critical waits for the report. If we get domain administrator on a Tuesday afternoon, you know on Tuesday afternoon.
The practice
A small team that says no a lot
Thirty-four analysts and engineers in Rennes. We work with operators whose downtime has consequences beyond a revenue chart, which is why we turn down more work than we take.
34 Analysts and engineers
2016 Practising since
340+ Engagements delivered
100% Work performed in the EU
Why the practice exists_
Most security work is sold on the promise of coverage. We think the useful question is narrower: what would actually happen if someone competent tried?
That question is harder to answer and much harder to invoice against a framework, but it is the only one that changes decisions. It is also why our reports are short, why our findings are reproducible, and why we would rather tell you three true things than forty defensible ones.
How we work
Four commitments, written into every contract
We write what we could not determine
Every report has a section on the limits of the engagement. An assessment that claims total coverage is describing a scope, not a reality.
The control belongs to your team
We write the evidence, your engineers own the system. A programme that collapses when the consultancy leaves was never a programme.
No finding is padded
A report with forty low-severity items exists to justify a fee. If we found three things that matter, the report has three things in it.
History
Ten years, one office
We have grown slowly on purpose. Every analyst who has run an engagement here was hired before we needed them.
- 2016
Founded in Rennes
Two people, one industrial client and a rented desk. The first engagement was a water utility that had never had its network mapped.
- 2019
PASSI qualification
Formal qualification for penetration testing and security audit, which opened work with public-sector operators.
- 2021
The SOC goes live
Continuous monitoring launched with four clients and a rotation of six analysts. Sovereign hosting from the first day.
- 2023
CERT team formed
A dedicated incident response cell, with a contractual thirty-minute engagement commitment for retainer clients.
- 2026
Thirty-four analysts
Still one office, still no offshore first line, still refusing engagements we do not think we are the right people for.
People
Who signs the work
Every report is reviewed by one of these three before it leaves the building.
AR
Anaïs Roux
Head of Compliance
Leads compliance engagements. Translates regulation into work an engineering team can actually schedule.
Read their posts CRCamille Roze
Co-founder & CTO
Co-founder and CTO. Fifteen years breaking industrial systems, now spent making them harder to break.
Read their posts KMKarim Mesbah
Head of Incident Response
Runs the incident response cell. On call the night most people are not.
Read their posts