We are the wolves,
not the prey.
FenryX was founded in Taipei in late 2025. We do one thing: find the vulnerabilities your organization doesn't know it has — using a genuine attacker perspective. We believe true defense can only be built by those who truly know how to attack.
The Name's
Origin
FenryX takes its name from Fenrir, the great wolf of Norse mythology — a symbol of unbound force and unpredictable threat. We added "X" to represent our direction: unknown attack vectors, unexplored vulnerability surfaces.
Our
Mission
Attack is not destruction — it is the first step toward understanding weakness.
We believe the best way to build resilient systems is to understand how they can fail. By entering from an attacker's perspective, we help organizations find weaknesses and harden defenses before real threats arrive — turning every simulated attack into an accelerator for technical growth.
Our
Four Tenets
Every decision at FenryX — from hiring to scope of service to how we present reports — is governed by these four core values. Not a poster on the wall, but a commitment written into every SOW.
Offense First
We approach every problem the way an attacker would. Defense begins with understanding how to attack.
Evidence-Driven
A vulnerability without a PoC is not a vulnerability. Every conclusion must be verifiable and reproducible.
Pack Mentality
No heroics. Team collaboration and information sharing are the true strength of any security team.
White Hat Ethos
We have the ability to break in — but more importantly, we know when to stop.
Held
Certifications
FenryX engineers hold industry-recognized offensive certifications. All technical capability is validated through real hands-on exams, not paper credentials.
Security
Research
FenryX engineers have responsibly disclosed 39 vulnerabilities (including 2 CVEs) on the HITCON ZERODAY platform, covering real systems in healthcare, food & beverage, e-commerce, and industrial control sectors. All reports have been remediated. Organization names are anonymized per responsible disclosure principles.
- ·Predictable JWT signing key — forged tokens bypass all API authentication
- ·Unauthorized API access — thousands of medical institutions fully exposed
- ·Prompt Injection — internal documents including bank account numbers leaked
- ·Patient appointment records (name, ID, phone) accessible without authentication
- ·Reversed APK revealed API access control flaw
- ·Unauthorized access to all employee national IDs, home addresses, bank accounts, and salary data
Our
Story
We are a new company, but we document every step. Here is FenryX's public timeline.
FenryX Founded
Founded in Taipei by senior penetration testing engineers, with a mission to build real security defenses from a real attacker perspective.
First Client Engagements
Began accepting founding client penetration testing engagements, all projects executed and delivered directly by the founders.
Ready to start
working together?
Tell us about your security needs. We'll get back to you within 3–5 business days.