Think Like an Attacker Find the Weakness
FenryX is an offensive security team founded in Taipei in late 2025.
We find the vulnerabilities attackers exploit — before they do.
Offensive Security
Services
Defense starts with understanding offense. Every engagement is executed by hands-on engineers who replicate real attacker behavior — from recon and intrusion to lateral movement and exfiltration.
Vulnerability Assessment
CVE/CWE-based full-asset scanning. Identifies known vulnerabilities and classifies them by risk level.
Penetration Testing
Certified engineers execute manual attack chains. Web, Mobile, Cloud, Network, IoT — black/white/grey box.
Social Engineering
Custom phishing campaigns simulate real attacker behavior — quantifying employee security awareness and actual risk.
Six-Phase
Kill Chain
Based on PTES / NIST SP 800-115 / OSSTMM — refined into the FenryX Six-Phase Kill Chain. Every phase has deliverables, tooling, and quality gates.
Reconnaissance
Passive intel gathering, attack surface mapping, digital fingerprinting.
Scanning
Active port/service scanning, web component enumeration, CVE/CWE cross-referencing.
Exploitation
Manual vulnerability validation, attack chain chaining, WAF/EDR bypass.
Post-Exploitation
Privilege escalation, lateral movement, persistence — assessing real data exfiltration impact.
Reporting
CVSS 3.1 ratings with PoC, impact scope, remediation guidance, and retest verification.
Retest
Full re-validation after fixes — confirming vulnerabilities are closed with no regressions.
Attackers
Never Sleep
Taiwan faces millions of external cyberattacks daily. We track global threat intelligence and arrive at your systems before the attackers do.
How We Find
Critical Vulnerabilities
Tools are to a security team what weapons are to a hunter. We use industry-leading automation, backed by manual verification of every finding.
app.post("/api/login", async (req, res) => { const { username, password } = req.body; const sql = `SELECT * FROM users` + ` WHERE name = '${username}'`; const user = await db.query(sql); if (user.password === password) { const token = jwt.sign({ id: user.id }, "hardcoded-secret-2024"); res.cookie("session", token); res.redirect(req.query.returnTo); }});Why Choose
a Lean Team
Every engagement is executed and delivered by the founders themselves — no outsourcing, no subcontracting. The person you contact is the person who does the work.
Certified Expertise
We hold HTB CPTS, CWES, PWPA and other offensive certifications — ability proven by real exam, not paper.
Real Attacker Perspective
Every report tells an attacker story — not a tool output PDF, but a readable operation record.
Flexible Schedule & Pricing
Engagements completable within 2–3 weeks; competitive pricing and flexible timelines during our founding period.
Web & Network Specialization
Focused on Web App / API, internal and external networks, and Active Directory attack surfaces.
Compliance-Aligned
Report structure references industry standards, suitable as internal audit reference documents.
Transparent Collaboration
No black-box pricing, mid-engagement progress syncs, verifiable testing process. Reports you can actually read.
Built on 5 International Certifications
Founded in late 2025, we believe certifications are not a destination — they are our baseline commitment to proven capability.
We are a team founded at the end of 2025. We have no impressive client list to show off — but we have a transparent methodology, a first-hand attacker perspective, and a commitment to making every report tell a complete attack story.
Latest Intelligence
FenryX publishes original vulnerability research, offensive tactics breakdowns, and security observations.
Common
Questions
If your question isn't listed below, reach out directly — we'll respond within 3–5 business days.
We define scope, test windows, and risk thresholds in the kickoff meeting, and maintain a 24/7 kill switch. High-risk attack modules are scheduled during off-peak hours or in isolated environments to minimize impact on live operations.
A vulnerability scan is automated, breadth-first, and finds known vulnerabilities. A penetration test is manual, depth-first — validating real exploitability and chaining attacks. We recommend quarterly scans and annual full-scope penetration tests.
Yes. We obtain legal approval, signed SOW, and employee disclosure statements before any engagement. All phishing infrastructure is built and destroyed by FenryX — no real sensitive data is ever accessed.
Vulnerability assessment: 3–5 business days. Penetration testing: 2–4 weeks. Social engineering: 4–6 weeks. Pricing is scoped per engagement — contact us and we will provide an assessment direction within 3–5 business days.
Yes. Every report includes prioritized remediation guidance, and one free full retest after fixes. Our lean team means you talk directly to the engineer who found the issue — no PM in between.
Yes. We have audit and penetration capabilities across AWS, Azure, and GCP. For cloud engagements we will help you complete the cloud provider authorization process in advance.
Your next engagement,
starts with FenryX.
Tell us about your security needs. We'll get back to you within 3–5 business days.