Work
What you can hire us for
Three kinds of work, scoped by the window rather than sold by the rung. No packages: a package is a promise about a target nobody has looked at yet.
Engagement
Commissioned research
You ship software, and would rather we found the problem than somebody else did.
A fixed window spent looking for flaws in something you build, own or depend on.
- An agreed window, usually weeks rather than days, against a target agreed in writing
- Attack surface mapping, source or binary review, and harnesses where they are worth building
- Every finding proved with a working reproduction before it reaches you
- A written report per finding: root cause, reachability, impact, and what closes it
- A debrief with your engineers, because the analysis is worth more than the document
Research does not come with a guaranteed result. A window can end with nothing, and a report saying so is the correct outcome rather than a failed engagement. Anybody promising a finding in advance is either padding severity or has already decided what to say.
Scoped in weeks, agreed in writing · Scoped and quoted
Engagement
Exploit development
You have a report, a crash or an advisory, and need to know whether it is really exploitable.
Taking a known flaw from 'something is wrong here' to a bounded answer about what it costs you.
- Reproduction of the reported behaviour, built into a case that fails reliably
- Root cause, not the symptom the crash reported
- What the bug grants in practice: the primitives, and how far they reach
- Whether existing mitigations still hold, and what is left once they are counted
- A proof of concept sized for the decision you have to make, and no further
This often ends with the answer that it is not exploitable, or not from anywhere that matters. That is worth paying for: it is the difference between a release-blocking emergency and a ticket for next quarter, and a severity score cannot tell you which you have.
Scoped against the specific flaw · Scoped and quoted
Engagement
Tooling built to order
Your team has the targets and the time, and is missing the thing that makes them tractable.
Harnesses, fuzzing infrastructure, triage pipelines and instrumentation, built for your target rather than in general.
- Harnesses that reach the code you actually care about
- Fuzzing setup, corpus work and the plumbing around a campaign
- Crash triage, deduplication and minimisation
- Instrumentation to see what a target is doing rather than what it reports
- Handover: your engineers run it afterwards, not us
Built to be handed over and maintained by you. If it needs us to keep running, it was built wrong.
Scoped against the target and the handover · Scoped and quoted
Not this
Three things this is not
Most enquiries here are the first one, and it has a real answer: Skull Solutions does that work.
-
Testing an application you run
An application security review is Skull Solutions' work: authentication, authorisation, logic, dependencies. It is what most people mean, it is a real service, and it is one link away rather than a refusal.
-
Exploits against software you do not own
We research targets we may lawfully research, or targets a client has authorised in writing. Access to somebody else's system is not sold here at any price.
-
Anything sold onward
No broker, no offensive-capability buyer, no exclusivity over a flaw. What we find goes to the vendor and then the public, and that is not negotiable per engagement.
Skull SolutionsWhere our work stops
Not sure which side of the line you are on?
Scoping
Nothing starts because you sent an email
Five steps between getting in touch and anybody looking at anything. You can stop at any of them.
-
You describe the target
What it is, whether you own it, and what a finding would change for you.
-
We say whether it is ours
Often it is not, and the honest answer is a link rather than a quote.
-
We agree the window and scope
In writing, including what is out of bounds and who had the authority to say so.
-
We quote against it
For the time, not a promised result. Nobody can honestly quote for a result here.
-
You decide
Nothing starts until you have said yes. Nothing renews on its own.
Software you do not own needs its owner's written authorisation as well as yours. Not a formality we can waive for a deadline.
Describe the target
What it is, whether it is yours, and what you need to know about it. A paragraph is enough.