We test the logic
We look at how APIs, user roles and workflows interact, and where the original design assumptions stop holding.
Independent researchers who test by hand.
HAK-MZ is an independent offensive security team. We started as bug hunters, and we still work like them: we study how a system really behaves and look for the assumptions that break.
Our approach
Why we test by hand
Scanners are good at known patterns. The serious bugs hide in authorization logic, state handling and trust between services, and finding them takes a person who understands how the system is meant to work.
Proof for every finding
Every issue is reproduced by hand with the exact requests. No false positives and no inflated severity.
Fixes engineers can use
Reports explain the root cause and give code-level or configuration fixes your team can apply right away.
What you get
A clear picture at the end
You finish with a map of how an attacker could get in, how to reproduce it, and what to fix first.
-
01
Depth over volume We focus on manual testing, not generic scanner playbooks.
-
02
Risk in your context Findings are rated against your real assets and data, not a generic score.
-
03
Direct access to the testers Debriefs are with the researchers who did the work, not account managers.
Team
Meet the people behind the tests
See who does the work and what each of us focuses on.