A 21-person research collective publishing 0-day tradecraft, running disciplined red-team operations for Fortune 500 engineering teams, and turning real exploitation paths into shippable defenses.
Four entries pulled from the public disclosure record. Each line is a real, vendor-coordinated finding — not a retrospective.
Sustained, hypothesis-driven 0-day hunting against operating systems, browsers, mobile platforms, and the embedded base that ships inside critical infrastructure. We publish what we find, after coordinated disclosure, and we ship the patch path with the advisory.
Multi-quarter adversary emulation against your production estate, scoped against the threat actors you actually face. TIBER-EU and CBEST aligned where applicable. Every operation ends with a defensible, time-stamped report your engineers can act on.
Our 6-person disclosure desk acts as neutral triage and shepherd for multi-party vulnerability reports — the team your external researchers call when they need a vendor to actually pick up. We ran 312 disclosure workflows in 2024 alone.
An embedded senior researcher on a quarterly cadence — reviewing architecture, scoping your engineering roadmap against emerging threats, and on-call for incident response when a CVE lands in your stack. Median client tenure: 2.7 years.
Three concrete formats. Each begins with a paid scoping week before any commitment on either side.
A 6–10 week operation against a defined environment, adversary profile, and objective set. Deliverable: a narrative report and a tabletop exercise with your detection team.
An embedded senior researcher on a quarterly cadence. Continuous pre-release review, architecture threat-modeling, and a 24-hour incident response SLA. The format most of our clients run on.
A short, paid engagement to triage an internal vulnerability report, scope remediation, and coordinate external researcher communication. Most often used by smaller security teams with no in-house disclosure desk.
Every engagement starts with a paid one-week scoping study — a flat $14,000 USD fee, credited against the engagement if we proceed. No NDAs required to discuss scope.
We started ExploitStation because the most useful thing an offensive researcher can do is publish. The work has to leave the building — in advisories, in patches, in engineers who understand how their own products break. Everything else on this site is downstream of that. The clients we keep are the ones who want the same thing.
