Contact us
Now accepting client engagements Book a scoping call

We find the flaws before attackers do.

Vexel is the security team you can enlist. We penetration test your applications, infrastructure and AI systems the way real attackers would, then stay with you to fix what we find and keep you secure.

Start an engagement What we do
  • Written authorization first
  • Every finding reproduced
  • Coordinated disclosure
Latest disclosure Vendor fixed

XerteGate

An exposed setup workflow and unsafe antivirus configuration in Xerte Online Toolkits that together formed a potential remote code execution chain.

  • CVE-2026-14261
  • CVE-2026-12116
  • VU#734812
  1. Found
  2. Validated
  3. Reported
  4. Patched
Fixed in v3.15.5 and v3.14.6 Read the writeup
Credited research
What we do

Penetration testing and ongoing security, from one team.

Bring us in for a single test or as your security team. Hands-on work by experienced people, not automated scanner output.

Web application and API penetration testing

Manual testing of your web apps and APIs for authentication, access control, injection and business logic flaws that scanners miss.

External and network penetration testing

We map what is reachable from the internet and test it: exposed services, admin interfaces, stale software and weak trust boundaries.

AI and LLM security testing

Prompt injection, data leakage and tool-use abuse testing for models and the applications built around them.

Your security team, on call

Enlist us as your security team: regular testing, reviews of new features before they ship, hands-on help fixing issues and retests to prove they are closed.

Discuss your scope Not sure what you need? Describe the system and we will recommend a scope.
How we work

A clear process, from scope to retest.

You always know what we are testing, why, and what happens next.

  1. Scope

    We agree targets, boundaries, timing and written authorization before any testing begins.

  2. Investigate

    Manual research led by experienced people, supported by tooling, inside the agreed rules of engagement.

  3. Validate

    Every finding is reproduced in a controlled environment. If we cannot prove it, we do not report it as fact.

  4. Report and retest

    Clear evidence, practical fixes and a retest once you have remediated. Disclosure only with your agreement.

Latest research

Vulnerabilities we have found and responsibly disclosed in public software.

View all research
Principles

Offensive skill, held to a strict code.

Every engagement runs under written rules of engagement that govern what we test, what we touch and what happens to the results.

  • Authorized work only

    No testing without documented permission and an agreed scope. Ever.

  • Minimal data access

    We collect only what is needed to prove impact, and never keep what we do not need.

  • Confidential by default

    Findings stay between us and you. Publication happens only through coordinated disclosure.

Now booking

Have a system that needs a closer look?

Tell us what you are building or running. We will reply with a proposed scope and next steps.

Contact us