Akshay Khandhadia

Security testing that reads like an attacker, reports like a partner.

Every engagement is manual-first, scoped around what actually matters to your business, and delivered with findings your team can act on the same day.

✦Web & API Penetration Testing

Deep, manual testing of web applications and APIs against the OWASP Top 10 and beyond — authentication flows, access control, business logic, and the edge cases scanners never reach. Delivered with clear exploitability and impact, so fixes get prioritised correctly.

Burp Suite Pro · SQLMap · OWASP

✦Mobile & Android Security

Static and dynamic analysis of Android applications in live and staging environments — reverse engineering, runtime instrumentation, and API traffic inspection to surface what's really exposed on the device.

Frida · Objection · MobSF · APKTool

✦Network & Active Directory

Internal and external infrastructure testing, Active Directory attack-path mapping, and red-team support — from initial foothold to domain compromise, with a clear remediation route back.

BloodHound · Responder · CrackMapExec · Nmap

✦Cyber Essentials Plus

End-to-end Cyber Essentials Plus assessment as a certified assessor — audits, testing, and independent quality review and sign-off of reports, so your certification stands up to scrutiny.

Certified CE+ Assessor

✦AI-Accelerated Security

LLM-assisted vulnerability triage, OSINT enrichment, report drafting, and rule and script generation — AI workflows engineered to make security work faster without losing rigour.

Python · LLM prompt engineering

✦Training & Enablement

Hands-on upskilling for security teams and practical education for internal users — turning testing findings into lasting capability rather than a PDF that gathers dust.

Team mentoring · Secure practice

Outcomes, not checklists.

Responsible disclosure

Hall of Fame × multiple organisations

Independently identified and ethically reported security vulnerabilities across multiple global organisations — recognised in their public halls of fame for responsible disclosure.

Regulated sectors

End-to-end VAPT for medical & eCommerce clients

Led full vulnerability assessment and penetration testing engagements in high-stakes sectors — owning scoping, testing, client queries, and working directly with development teams to verified resolution.

Test engineering

40% faster test execution

Designed bespoke security test cases and scripts tailored to client requirements, cutting execution time by 40% without narrowing coverage.

Automation

70% reduction in runtime

Automated manual testing aligned to the MITRE ATT&CK framework in Python — a 70% reduction in execution time and a dramatically leaner pipeline.

Red team

Active Directory attack paths

Mapped and exploited AD attack paths using BloodHound, Responder and CrackMapExec, supporting red-team engagements, cloud security assessments and firewall configuration reviews.

Assurance & QA

Cyber Essentials Plus sign-off

Review and final approval of Cyber Essentials Plus reports for accuracy and quality — independent assurance that certifications are earned, not rubber-stamped.

A process built on clarity.

Scope

We define what matters: the systems in play, the risks that keep you up at night, and exactly what success looks like. No padded scopes, no surprise invoices.

Attack

Manual-first testing with an attacker's mindset, backed by industry tooling and AI-accelerated triage — covering the ground a scanner covers in a fraction of the time, then going far beyond it.

Report

Findings ranked by real exploitability and business impact, written for both the board and the developer fixing the bug. Every issue comes with a clear route to remediation.

Resolve

I stay in the loop with your development team until issues are verified as fixed — because a vulnerability isn't closed when the report lands, it's closed when the risk is gone.

Security testing that reads like an attacker, reports like a partner.