Any signed-in user can read another tenant's invoices
GET /api/invoices/8812
Cookie: session=tenant-b
HTTP/1.1 200 OKAbout Envenox
Software development, with an attack team built in
Envenox is a software development company that keeps an offensive security practice on staff. We design and ship production systems, and the same sprint puts them in front of people whose job is to break them, so what reaches your users has already survived an attack.
- Builders and attackers in one team, one backlog
- A threat model written before the first commit
- Findings delivered as tickets and pull requests, not a PDF
- Every fix retested before the ticket closes
- A written proposal within three to five days of the first call
- db.invoice.findUnique({ where: { id } })
+ db.invoice.findFirst({
+ where: { id, tenantId: session.tenantId },
+ })Passed 48 testsRetest now returns 404
60 minutesto scope your project
Sample finding and fix, shown for illustration
Platforms and tools we work with
- TypeScript
- React
- Next.js
- Node.js
- Python
- Go
- PostgreSQL
- Redis
- Kubernetes
- Terraform
- Google Cloud
- GitHub Actions
Our services
Software we build. Systems we break.
Two practices under one roof: a development team that ships production systems, and a security team that attacks them.
Custom software
Systems built to survive an audit, a breach attempt and a handover.
Discuss thisWeb applications
Fast on a throttled corporate network, correct without JavaScript, and accessible by construction.
Discuss thisPlatform & DevOps
Deployment that is boring, and a rollback somebody has actually rehearsed.
Discuss thisERP
The processes you actually run, not the ones a vendor template assumes.
Discuss thisCRM
A pipeline your sales team updates because it helps them, not because it is mandated.
Discuss thisHRM
Employee data handled with the care a regulator expects, and a joiner process that finishes.
Discuss thisLMS
Completion you can evidence to an auditor, and content people finish.
Discuss thisQA & test automation
A suite people trust enough to block a release on.
Discuss thisPenetration testing
Findings your engineers can fix on Monday, not a PDF nobody opens.
Discuss thisApplication security
Fix the class of bug, not the instance. Then make it impossible to reintroduce.
Discuss thisCloud security
The identity graph, not the misconfiguration list.
Discuss thisGRC & compliance
Certification as a by-product of controls that work, not a parallel paperwork exercise.
Discuss thisDetection & response
Analysts who read your architecture before they read your alerts.
Discuss thisIncident response
A responder who knows your systems, and a forensic record that holds up afterwards.
Discuss thisRed teaming
A test of your detection and response, not of your patch level.
Discuss thisvCISO
Security leadership at the board table, at a fraction of a hire.
Discuss thisEnvenox in numbers
- 16Services across two practices
- 2In-house teams: builders and attackers
- 60minScoping call with the engineer who would lead
- 3–5daysTo a written, fixed proposal
Industries we serve
Built for regulated, high-stakes work
Sectors where a breach or an outage costs more than the project did.
- Financial services
- Healthcare
- SaaS & technology
- Logistics
- Public sector
- Retail & payments
How we work
The Adversary Loop
Threat models shape the build. The build gets attacked. The attack rewrites the threat model.
Book a scoping callModel
Before the first sprint, with the engineers who will own each component. The cheapest security finding is an architecture decision.
Build
Two-week sprints, trunk-based, deployed to staging continuously. Security reviews each architectural decision record as it is written.
Attack
Continuous review of the sensitive paths during the build, then an independent pre-release test by a tester who wrote none of the code.
Watch
Detections written for the system as built, by people who have been reading it for months rather than meeting it at handover.
Rewrite
What the testing and the monitoring find goes back into the threat model. That is the loop, and it is why the second year costs less than the first.
05 returns to 01, Model. The output of 05 is the input to 01. That return path is the only unusual part of this, and it is the part that requires both practices to be in one firm.
Engagement models
Four ways to work with us
No published price list: every engagement is quoted in writing after a scoping call.
Fixed-scope project
A defined outcome, an agreed scope and a delivery date, quoted as one piece of work.
Programme
A longer body of work delivered in phases, planned and reviewed with you as it goes.
Security retainer
Ongoing security capacity, from testing to response, available when you need it.
Embedded team
Our engineers and testers working inside your team, to your cadence.
- Scoping call60 minutes
- Written proposal3–5 days
- Contracting1–2 weeks
- Mobilisation1–3 weeks
Technology stack
The technology we work with
Mainstream, well-supported technology your own team can maintain after we hand over.
- TypeScript
- React
- Next.js
- Node.js
- Python
- Go
- PostgreSQL
- Redis
- Kubernetes
- Terraform
- Google Cloud
- GitHub Actions
- Argo CD
- Vitest
- k6
- AWS & Azure
- Playwright
- Wazuh & Sentinel
FAQ
Frequently asked questions
What most teams ask us before the first call.
01Can we hire you only to build, or only to test?
Yes. Most clients start with one practice. The Adversary Loop is how we work when we do both, and it is where having both teams pays for itself.
02How much does a project cost?
Every engagement is quoted after a 60-minute scoping call. The written proposal, with scope, team and price, arrives within three to five days.
03How do engagements run?
Four ways: a fixed-scope project, a programme, a security retainer, or an embedded team. The proposal says which one fits your work and why.
04How soon can work start?
Contracting usually takes one to two weeks, and the team mobilises one to three weeks after that.
05Which industries do you work in?
Financial services, healthcare, SaaS and technology, logistics, the public sector, and retail and payments.
06What happens to a vulnerability you find?
It becomes a ticket in your tracker with the request that proves it, a pull request that fixes it, and a retest before the ticket closes.
Contact us
Have something to build, or something to break?
Tell us what you are working on. We will set up a 60-minute scoping call with the engineer who would lead the work.
- Emailadmin@envenox.com
- ResponseA named engineer replies within one business day
- Next stepA 60-minute scoping call, then a written proposal