Offensive security, Tallinn and remote

We check the locks.

Kiln is a small security practice in Tallinn. We are hired to attack systems under agreed rules and to write down what we found, how we found it, and what we could not establish.

Arrange a call Read our notes

Collage of a magnifying glass over redacted documents beside a closed padlock and a coiled chain

2019 Founded, Tallinn
7 People
9 Engagements a year
19 Advisories published

most findings are configuration, not code
the asset register is usually out of date
CI/CD is production, whatever the diagram says
the failed routes are worth writing down
identity is where the boundaries actually are
a fix that holds at ninety days is a fix

most findings are configuration, not code
the asset register is usually out of date
CI/CD is production, whatever the diagram says
the failed routes are worth writing down
identity is where the boundaries actually are
a fix that holds at ninety days is a fix

Capability

Our Services

Six kinds of engagement. All of them are people reading systems carefully; none of them is a product, and none of them runs without you.

Adversary simulation

Typical engagement: 8 weeks

An attack against your live estate, under rules you set. We work from the outside in and record the route as we go.
Ask about this
Application testing

Typical engagement: 6 weeks

Review of web, mobile and API surfaces, with the source where you can share it. Findings come with something you can reproduce.
Ask about this
Cloud and identity

Typical engagement: 4 weeks

AWS, Azure and GCP tenancy review: role chains, trust boundaries, and credentials that outlived whoever issued them.
Ask about this
Vulnerability research

Ongoing

Research on software we and our clients depend on. Nineteen advisories published so far, all coordinated with the vendor.
Read the advisories
Detection engineering

Typical engagement: 3 weeks

Turning an engagement into detections. We write rules for what we did, then check with your team whether they fire.
Ask about this
Incident response

Retainer

Help during and after an incident, for clients on a retainer. Containment first; attribution only where the evidence supports it.
Ask about this

Team

Seven people.

You are told who will be working on your systems before the engagement starts. Four of us are below; three work under client agreements that do not allow a public profile.

Principal

Eleni Sarris

Writes the rules of engagement and leads the longer jobs.
Head of research

Marcus Bramwell

Most of our published advisories came out of his research.
Cloud and identity

Nadia Okonjo

Came from platform engineering; sends findings as pull requests.
Detection engineering

Tomas Reinholt

Works on the defensive half, and on whether the rules fire.