Trust
Verified today, clear about tomorrow
Plain language on what you can hire us for now, what is already in production, and what is still on the roadmap. No invented badges.
Verified today
- People-led services in two pillars, AI Security and Cyber Security & Resilience Services (security leadership, consulting, human-led penetration testing and audits, compliance and risk preparation, cloud security, training, disaster recovery, and business continuity), delivered under written scope by senior practitioners.
- Every test runs only on systems with verified ownership and signed scope. We never test prospects, customers of prospects, or third parties.
- Findings are validated by a person, reported with reproduction steps and remediation guidance, and re-tested after fixes.
Accountable by design
- Every engagement starts with a written scope and an accountable lead, so leadership knows who answers for the outcome and what was agreed before anything runs.
- We do not publish customer names here because we respect their privacy. On request, we can provide named references and recommendations from other projects when those customers agree.
- No pricing is published. Each engagement is scoped individually, so spend is agreed in writing up front.
In progress
- Pentforge hosted testing on pentforge.app - planned. Automated reports stay labelled an unvalidated first pass until a person validates them.
- The security and AI security platform - planned. Capabilities are announced only when built.
How we work
How we work - the workflow, running live
How to read validation evidence
Automated results are candidates until reviewed by a person. Anything that could not be confirmed must stay labelled unconfirmed, with the missing evidence explained.
A captured page or traffic replay shows observed behaviour. It cannot confirm a server-side exploit. Confirmation requires an approved, contained executable replica, with evidence for the exact replica build tested. Live production and generic staging environments are outside this validation boundary.
Evidence must identify the environment tested. A replica result is never proof that the same exploit ran on your live production system. Hosted testing remains planned.
What we do not claim
- Pentforge does not issue compliance certificates and is not itself an accredited certification body. Our compliance work is preparation support designed for frameworks such as ISO 27001, ISO/IEC 42001, GDPR, NIS2, DORA, the EU AI Act, and the Cyber Resilience Act - never a certificate. That is separate from the real, individually earned professional credentials our practitioners hold - see About for the confirmed list.
- No autonomous testing claims: people validate findings and people can stop any run.
- We do not publish customer names because we respect their privacy. On request, we can provide named references and recommendations from other projects when those customers agree.
If a claim on this site ever proves wrong, we correct it the same day and note it here when it was material.
If something goes wrong
Ask for human help with scoping, an engagement problem, a finding, or a re-test. The contact page explains what to include and where to send your request. How to get help.