We operate. We don't scan.

We discover what others don't see.

Not a scanner, not an agency: we are adversarial operators. We execute against production infrastructure and demonstrate real exposure — with evidence, not alerts.

Request operation View operational record

Operated, not licensed Proof, not scores Zero false positives

ENGAGEMENT STATUS ACTIVE ASSESSMENT Controlled offensive testing on authorized production scope

MODE OPERATED

TARGET PROD

VALIDATION POC

STATUS VERIFIED

Surface mapped

Adversarial path validated

Exploitability confirmed

LIVE

+2,500 Findings discovered in production

+40 Global enterprise operations

0% False positives · forensic standard

24h Delivery on selected operations

Direct Operations

Assessments are executed by adversarial operators against the agreed scope rather than relying on generic dashboards.

Zero-Day Capability

Research into deep logic, identity, API and architectural flaws that automated scanners may fail to identify.

Forensic Evidence

Every validated finding is accompanied by technical evidence required to understand impact and support remediation.

Approach comparison · 01

Real risk isn't measured by counting alerts.

An adversarial assessment should demonstrate what an attacker can actually achieve, not generate another dashboard. In a world where anyone can scan with one click, we prove what no tool can.

LEGACY SIGNAL NOISE

Scanners and agencies

Generic reports and alert volume, without exploitation certainty.

01
Alert volume
Large quantities of findings still require manual validation.
02
Perimeter limitations
Scanning may stop where WAFs, authentication and internal logic begin.
03
Limited context
A severity score alone does not demonstrate real business impact.
04
More triage
Internal teams must separate genuine signal from operational noise.

ZEKRO VERIFIED

Proof, not scores.

Demonstrable evidence of exploitation and impact.

01
Real validation
Reported findings are validated within the authorized scope.
02
Adversarial context
Assessment considers attack paths, logic, identity and real infrastructure behavior.
03
Demonstrable impact
Technical evidence explains what can happen and why it matters.
04
Precise remediation
Actionable information to close exposure and validate the fix.

Verified operations · 02

Evidence from the field. Not demos.

Operations executed against protected infrastructure and high-criticality environments.

01 EUROPE / ENTERPRISE

Critical exposure in financial infrastructure Germany · Multinational operation

Adversarial operation against financial infrastructure spanning four countries. Within 24 hours, critical and high-severity vulnerabilities were identified affecting confidential data and cloud infrastructure.

Findings

Critical

24h

Delivery

02 ZERO-DAY / IDENTITY

Validation bypass in Keycloak 18 CWE-347 · Identity

Discovery of a Zero-Day associated with JWT object validation, affecting the OAuth authorization flow within the assessed environment.

0-Day

Identity

CWE-347

Signature

100%

PoC

03 PRIVILEGE ESCALATION

Privilege escalation in six requests Authorization Logic

Assessment of a business-registration platform where a logic chain demonstrated privilege escalation within the authorized scope.

Requests

+725

Records

Alerts

04 CRITICAL INFRASTRUCTURE

Forensic analysis of critical infrastructure Encrypted Delivery

Forensic analysis of identity and civic computing infrastructure. Critical vulnerabilities and attack chains were identified, with evidence delivered under cryptographic controls.

Vulnerabilities

Attack Chains

AES

256

BEFORE IT BECOMES EXPLOITABLE

Find it before they do.

Book confidential session

Working method · 03

From exposed surface to certainty.

RECON

Recon

We map exposed applications, APIs, cloud infrastructure and forgotten assets.

INFIL

Infiltrate

We assess business logic, identity, access controls and adversarial paths.

PROVE

Prove

We technically validate impact and gather reproducible evidence.

VERIFY

Verify

We re-test after remediation to confirm exposure has been closed.

Technical evidence · 04

A vulnerability isn't real until it's demonstrated.

We assess business logic, identity chains and cloud architectures where automated scanners lose context.

VALIDATED TRAJECTORY

Verified compromise trajectory

● VERIFIED IN PRODUCTION

01 / RECON

Surface mapping

Exposed OIDC endpoint discovered during attack-surface reconnaissance.

/protocol/openid-connect

02 / PERIMETER

Perimeter controls

Assessment of real behavior behind defensive controls and authentication.

CONTROL PATH

03 / LOGIC

Validation failure

Unsafe validation condition identified within the identity flow.

CWE-347

04 / IMPACT

Impact

Impact validated under authorized conditions and scope.

CRITICAL

TARGET idp.target-financial.com

VECTOR CWE-347

STATUS VERIFIED

POST /auth/realms/enterprise/protocol/openid-connect/token HTTP/2
Host: idp.target-financial.com
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Accept: application/json

grant_type=authorization_code
&client_id=fintech-core-client
&code=SplxlOBeZQQYbYS6WxSbIA
&redirect_uri=https://idp.target-financial.com/callback
&request=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0...

HTTP/2 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid profile email",
  "user_context": {
    "role": "global_admin",
    "status": "verified"
  }
}

--- a/src/services/oidc/token_validator.py
+++ b/src/services/oidc/token_validator.py

@@ validate_request_object(...)

- decoded = jwt.decode(
-     request_jwt,
-     options={"verify_signature": false}
- )

+ header = jwt.get_unverified_header(request_jwt)
+
+ if header.get("alg") in ["none", None, ""]:
+     raise SecurityException(
+         "Unsigned request object rejected"
+     )
+
+ decoded = jwt.decode(
+     request_jwt,
+     client_public_key,
+     algorithms=["RS256", "ES256"]
+ )

ILLUSTRATIVE EXAMPLE · SANITIZED DATA — Details of real operations remain under strict confidentiality.

Operational models · 05

Different scopes. The same certainty.

Operations adapted to the organization's attack surface, context and criticality.

01 FOCUSED

Core Strike Assessment

Focused operation against a critical asset, core API, primary application or prioritized surface.

Priority domain or API
Transactional logic
Adversarial assessment
PoC validation
Executive and technical report
Priority delivery

Request operation ↗

PRIMARY DEPLOYMENT

02 FULL SURFACE

Full Surface Adversarial Audit

Comprehensive assessment of applications, APIs, cloud, identity and transactional logic.

Asset inventory
Business Logic Testing
Attack-chain analysis
SARIF integration
Letter of Attestation
Re-testing included

Request operation ↗

03 CONTINUOUS

Continuous Offensive Validation

Continuous adversarial assessment for organizations with critical attack surfaces and persistent exposure.

Continuous operations
Zero-Day hunting
Advanced adversarial techniques
On-demand re-testing
Confidential channel
Compliance support

Contact liaison ↗

Operational assurance · 06

Built to operate where it matters.

No simulations

Reported findings must be backed by evidence.

Production Safe

Operations are designed around agreed technical boundaries.

Confidential delivery

Controlled and encrypted handling of evidence and sensitive information.

Letter of Attestation

Documentation for audits, compliance and boards.

ZK VERIFIED 2026

EVIDENCE CERTIFICATION

Formal Adversarial Posture Certification

Technical attestation for Audit Committees, Boards of Directors, Investment Funds and compliance teams.

Zekro Intelligence S.A.S. certifies that assets within the authorized scope were assessed using controlled adversarial procedures.

Reported vectors were accompanied by technical evidence and may be validated again following remediation.

ID ZEKRO-ATT-2026-0914-774

METHOD ASVS / MITRE ATT&CK

SHA256 8f4e2b7a9c1d0e5f...c1d0e5f

Frequently asked questions · 07

Frequently asked questions.

How is Zekro different from a scanner or traditional penetration test?

Zekro performs adversarial assessments within the agreed scope and prioritizes verifiable evidence over alert volume.

Is it safe to operate against production infrastructure?

Operations are planned with the organization and executed within defined technical boundaries to minimize operational risk.

What exactly is delivered with each finding?

Technical evidence, impact context, finding traceability and remediation guidance. Depending on scope, re-testing and a Letter of Attestation may also be included.

How do I get started and how long does it take?

The process begins with a confidential session to define the attack surface, constraints and objectives. Duration depends on scope.

CONFIDENTIAL SESSION

Know your real exposure before adversaries do.

One confidential operation. Verifiable evidence. No noise.

Request operation sales@zekro.io WhatsApp · Direct channel