Security for the AI era & legacy reality
Boutique cybersecurity for corporations, manufacturers, SMEs, and Web3 teams. Senior-led penetration testing, AI red teaming, OT/ICS assessments, and tokenization security — delivered with real attacker experience.
$ whoami
CEH · OSCP · CSCA · 20+ years
$ scope --target ai,ot,legacy,web3
AI red teaming · OT/ICS · Legacy · Web3 · Tokenization · RWA
$ status
Ready for engagement
Security for the AI era & legacy reality. Boutique cybersecurity for corporations, manufacturers, SMEs, and Web3 teams. Senior-led penetration testing, AI red teaming, OT/ICS assessments, and tokenization security — delivered with real attacker experience.
We simulate real-world cyberattacks on your systems, networks, and applications to uncover vulnerabilities before malicious actors do — delivering a clear picture of your true risk exposure across IT, OT, and AI-enabled environments.
Operational technology and industrial control systems require specialized approaches. We assess PLCs, SCADA, IoT devices, network segmentation (Purdue model), and IT/OT convergence points to protect production lines, supply chains, and critical processes from disruption — including unprepared legacy systems.
LLM-powered applications introduce attack surfaces traditional tools do not cover. We test against prompt injection, jailbreaking, data exfiltration, and agentic privilege escalation. We also use AI to accelerate traditional pentests while senior engineers validate complex paths.
Jacobo Avariento has worked in offensive security since 2005. He started in public vulnerability research, including a stored cross-site scripting flaw in phpMyAdmin and the analysis and exploit he published for the Apache mod_rewrite off-by-one, CVE-2006-3747. Researchers at the University of California, Irvine later used that exploit as a live test case in work funded by the U.S. Air Force Research Laboratory, and the same work is cited in their ACM EuroSys paper. He then co-founded a university security consultancy, led authorized tests of online banking, mobile banking, and payment systems for banks across Latin America, and was technical lead of security testing for the European Central Bank at Airbus. That testing ran against the OWASP Testing Guide, NIST SP 800-115, OSSTMM, and PTES.
Since then he has done the same work from inside the companies that ship the systems. He has run threat modeling, security champions, bug bounty, and retesting at a neobank, a global news organization, EY, game studios, and a large consumer social application. At Rootstock Labs he reviewed smart contracts, bridges, and wallets on a Bitcoin sidechain, using fuzzing, invariant tests, and formal verification. He is Security Lead at Midas, responsible for security strategy, controls, and third-party risk for a tokenized-asset product. In public he publishes on the failures that move value: storage collisions in upgradeable contracts, ERC-4626 share inflation, and Solana operational failures around keys, stake authority, and multisig configuration. He holds OSCP.
For a client, the engagement is written down before any test starts. Defensahacker takes authorized penetration tests, retainers, and advisory reviews of systems that hold other people's money or data: banks and payments, product-security programs, and tokenized funds, vaults, and real-world assets. The client gets a threat model, an attack under that scope, evidence a product owner can act on, and a retest after the fix. He does not test a system he has no permission to touch, and client findings stay with the client.
No junior analysts. Every engagement is led by a senior engineer with real attacker experience.
Findings are written for CISOs and risk committees — attack narrative, proof, and remediation path.
Ethical hacking and penetration testing let your company identify and remediate weaknesses and vulnerabilities before real attackers exploit them.
Deep experience across corporations, SMEs, manufacturing, pharmaceuticals, automotive, industrial operators, and Web3, tokenization, and RWA platforms — including IT/OT environments.
Train for certifications and real-world pentesting with quizzes, flashcards, and scenarios. Available on iOS and Android.
Offensive security engineer since 2005. Public vulnerability research, technical lead of security testing for the European Central Bank, and security leadership for tokenized funds and real-world assets. OSCP.
Ready to discuss your security needs? Reach out and we will get back to you shortly.
contact@defensahacker.com