Penetration Testing & VA
Manual, in-depth testing and vulnerability assessment of web applications, APIs, internal and external infrastructure and IoT devices, with proof of exploitation and a prioritised remediation plan.
Available for new engagements
Break it, then build it
secure by design.
R.I. CyberSec is an independent security engineering and offensive security practice based in Amsterdam. We find what's exploitable through penetration testing and code review. We then help you fix it for good, by hardening Linux and Microsoft environments, tightening identity and access, and building security into your pipelines.
5+ yrsoffensive & defensive security
OWASPaligned testing methodology
EN · ITreports in English or Italian
// services
What we offer
We cover both offence and defence: we test your systems the way an attacker would, then engineer the controls that keep them secure. That can be a one-off pentest or an ongoing security partnership.
Secure Code Review
Line-by-line review of your codebase (Python, Go, TypeScript, Java, C/C++, Rust) against OWASP standards, focused on real exploitable bugs rather than noise.
Infrastructure Hardening
Secure configuration of Linux servers and Microsoft environments (Active Directory, Entra ID, Microsoft 365) based on CIS benchmarks and vendor best practices, including IAM, least privilege and logging.
DevSecOps & Automation
Secret detection, SAST pipelines and custom security tooling built into your CI/CD, with false-positive filtering so developers trust the alerts.
Detection & Incident Support
Alert investigation and threat hunting across EDR, NDR, SIEM and Microsoft 365, plus support when something already looks wrong.
AI & LLM Security
Security assessments of LLM-powered features, along with AI-assisted vulnerability discovery and triage based on our academic research.
// about
Hi, I'm Riccardo.
R.I. CyberSec is run by Riccardo, a security engineer and penetration tester with a background in application security, vulnerability research and secure software development.
I have tested web apps, IoT devices and infrastructure for enterprise clients at a global IT consultancy, and researched AI-driven vulnerability discovery at a university security lab, where that work was published at a top-tier security conference. I now build security tooling, harden infrastructure and handle incidents in the financial sector. I hold an M.Sc. in Computer Systems Security from Vrije Universiteit Amsterdam.
When you work with R.I. CyberSec, the person you talk to is the same person who does the testing.
- 2024 →Security EngineerFinancial sector
- 2023–24Security ResearcherUniversity security lab · AI & vulnerability discovery
- 2021–23Penetration TesterGlobal IT consultancy
- M.Sc.Computer Systems SecurityVrije Universiteit Amsterdam
// process
How an engagement works
- 01
Scoping
A short call to understand your systems, goals and constraints. You get a fixed quote and a written scope.
- 02
Testing
Hands-on testing within agreed rules of engagement. Critical issues are reported to you immediately.
- 03
Reporting
An executive summary for management and step-by-step technical findings with remediation advice for engineers.
- 04
Retest
Once fixes are in, we verify them and issue an updated report you can share with customers or auditors.
// contact
Request a service
Tell us a bit about what you need and we'll get back to you within two business days, usually sooner.