Security for the AI era & legacy reality

DEFENSAHACKER

Boutique cybersecurity for corporations, manufacturers, SMEs, and Web3 teams. Senior-led penetration testing, AI red teaming, OT/ICS assessments, and tokenization security — delivered with real attacker experience.

Start a conversation View services
defensahacker ~ recon

$ whoami

CEH · OSCP · CSCA · 20+ years

$ scope --target ai,ot,legacy,web3

AI red teaming · OT/ICS · Legacy · Web3 · Tokenization · RWA

$ status

Ready for engagement

Security for the AI era & legacy reality. Boutique cybersecurity for corporations, manufacturers, SMEs, and Web3 teams. Senior-led penetration testing, AI red teaming, OT/ICS assessments, and tokenization security — delivered with real attacker experience.

20+
Years Experience
CEH
Certified Ethical Hacker
OSCP
Offensive Security Certified Professional
CSCA
Certified Smart Contract Auditor
Services

What we do

01
⚔

Penetration Testing

We simulate real-world cyberattacks on your systems, networks, and applications to uncover vulnerabilities before malicious actors do — delivering a clear picture of your true risk exposure across IT, OT, and AI-enabled environments.

Web AppNetworkAPICloudOT
02
⚙

OT/ICS & Manufacturing Security

Operational technology and industrial control systems require specialized approaches. We assess PLCs, SCADA, IoT devices, network segmentation (Purdue model), and IT/OT convergence points to protect production lines, supply chains, and critical processes from disruption — including unprepared legacy systems.

PLCsSCADAIoTPurdueSupply Chain
03
🤖

GenAI Red Teaming

LLM-powered applications introduce attack surfaces traditional tools do not cover. We test against prompt injection, jailbreaking, data exfiltration, and agentic privilege escalation. We also use AI to accelerate traditional pentests while senior engineers validate complex paths.

Prompt InjectionAgent SecurityData Leak
About

Built on real experience

Having worked as a consultant and penetration tester for top-tier banks, the European Central Bank, pharmaceutical, automotive, and manufacturing companies across several regions and continents — we have vast experience with all types of companies and engagements, including industrial and operational technology environments, as well as tokenization, Web3, and real-world-asset (RWA) platforms.

Founded by Jacobo Avariento, a Certified Ethical Hacker (CEH) and Offensive Security Certified Professional (OSCP) with over two decades of hands-on experience in cybersecurity.

CEHCertified Ethical Hacker
OSCPOffensive Security Certified Professional
CSCACertified Smart Contract Auditor
20+Years Experience
Why Us

Why Defensahacker

Senior-led

No junior analysts. Every engagement is led by a senior engineer with real attacker experience.

Business impact

Findings are written for CISOs and risk committees — attack narrative, proof, and remediation path.

Fix it before they do

Ethical hacking and penetration testing let your company identify and remediate weaknesses and vulnerabilities before real attackers exploit them.

Industry experienced

Deep experience across corporations, SMEs, manufacturing, pharmaceuticals, automotive, industrial operators, and Web3, tokenization, and RWA platforms — including IT/OT environments.

App

Mastering Ethical Hacking

Train for certifications and real-world pentesting with quizzes, flashcards, and scenarios. Available on iOS and Android.

App Store Google Play
Team

The team

JA
Jacobo Avariento
Founder & Security Lead

Certified Ethical Hacker and lead security engineer with more than two decades in cybersecurity, with experience across banking, manufacturing, pharmaceuticals, and industrial environments.

FAQ

Frequently asked questions

What is penetration testing and why does my company need it?
A penetration test is a controlled simulation of a cyberattack against your systems, applications, or network. Corporations, SMEs, and manufacturing companies use it to satisfy ISO 27001, NIST, IEC 62443, and to find paths into critical systems, production environments, and operational technology.
How is a smart contract audit different from a traditional security audit?
Token contracts are immutable once deployed, so a flaw in issuance, redemption, or share accounting is a balance-sheet problem. A smart contract audit combines manual review with fuzzing and invariant testing, and covers the off-chain systems — frontends, APIs, allowlists, and admin keys — where tokenized-asset losses usually start.
What is GenAI Red Teaming and does my AI product need it?
GenAI red teaming tests LLM-powered applications against prompt injection, jailbreaking, data exfiltration, and agentic privilege escalation. Any organization using LLMs for operations, support, engineering, or decision support — including manufacturing and industrial environments — has an attack surface traditional tools do not cover.
What does security look like for a manufacturing or industrial company?
We assess the full IT/OT boundary: network segmentation following the Purdue model, PLC and SCADA exposure, industrial IoT devices, remote access, and supply-chain entry points. Findings prioritize safety and production continuity alongside traditional confidentiality and integrity.
How long does a penetration test take?
Scope determines timeline. A web application pentest typically runs 3–5 days. A full internal network assessment spans 1–2 weeks. Smart contract audits for a medium-complexity protocol take 5–10 days. We include a retest of all critical findings at no extra charge.
Contact

Start a conversation

Ready to discuss your security needs? Reach out and we will get back to you shortly.

contact@defensahacker.com