NYX SEC is an offensive security and AI red-teaming consultancy. We think like the adversary — probing your applications, infrastructure, and AI systems for the weaknesses real attackers reach for first.
Your LLM apps and AI agents, attacked the way a real adversary would — prompt injection, RAG poisoning, agent privilege escalation, and data exfiltration. Mapped to the OWASP LLM Top 10. Not benchmarked, broken.
Web, network, and infrastructure — tested by hand, end to end. External and internal, application to post-exploitation.
Locks, badges, and people. We test the physical path into your building — tailgating, badge cloning, lock bypass, and on-site social engineering.
Know where you're exposed before anyone tests it. Architecture review, AI/agent design risk, and secure-by-design guidance.
The human layer is part of the attack surface. Phishing simulation, staff and developer training, delivered on-site or remote.
Targets, boundaries, and rules of engagement, defined in writing before we touch anything.
We map the surface, then attempt real exploitation by hand — the path a motivated adversary takes.
Every finding with evidence, business impact, severity, and exact reproduction steps. No filler.
Once you've remediated, we verify the fixes actually hold against the original attack.
We don't run a scanner and hand you a PDF. We attack your systems the way a motivated adversary would, then show you exactly how we got in and how to close the door behind us.
How we work ▸Tell us what you're building and what you're worried about. We'll come back with a scope, a timeline, and a quote.
