I.
Scope over volume
Scanners find what is already known and named. The findings that matter come from sitting with a system long enough to ask questions a tool cannot frame.
NoctuaSec
EngageAUTHORIZATION & ACCESS CONTROL
We examine systems the way capable opponents will.
NoctuaSec conducts authorized security assessments – authorization logic and access control, in web applications and in physical and hardware systems – alongside published research on cyber conflict and defense policy.
§ IScroll to read
§ II — Mission
An assessment is only as good as the evidence behind it.
Every finding comes with reproducible evidence. Where a control works, we say so. Where we cannot establish something, we say that too.
§ III — Approach
How we work.
II.
Manual examination over automated coverage
A narrow assessment done properly is worth more than broad coverage done quickly. We would rather examine one area to the end than survey five.
§ IV — Practice
Our Services.
№ 01Practice
Physical & Hardware Access Control
Service interfaces of electronic locks, RFID/NFC card cryptography, hardware memory extraction where authorized, compensating controls review. 5–9 days, on-site or with a sample unit provided.
№ 02Practice
Authorization & Access Control in Web Applications
Authorization logic, role and permission boundaries, privilege escalation, object-level access control, exposure of administrative functions. 4–6 days, remote, staging preferred.
№ 03Practice
Remediation Verification
Verification that reported vulnerabilities are resolved, bypass attempts against the implemented fixes, review of the updated access matrix. 1–2 days, remote.
№ 04Practice
Technical Consulting
Scoped consulting on authorization and access control design, threat modeling for a specific system, technical review of assessment scopes.
§ V — Fieldwork
Selected engagements, redacted where necessary.
Physical Access Control2026
Access control in a hospitality facility used as student housing
Nine days, authorized. Three vectors: electronic lock service interfaces (Onity HT series), RFID/NFC key card cryptography (MIFARE Ultralight C, 2K3DES), and EEPROM extraction over I2C. Several existing controls held. Of six findings, five are architectural and cannot be closed by configuration alone. Formal acknowledgment issued by the facility director.
Healthcare2025
Authorization architecture in a healthcare application
Two weeks, authorized. An application handling patient medical records, operated by a development company on behalf of healthcare providers. Five findings — three critical, two high. Privilege escalation from a standard user account to full administrative takeover, exposing personal and medical data across the entire user base. Remediation initiated. Written acknowledgment from the CEO.
Training2025
Mentored red team exercise
Two months, four-member team, mentored by Gynvael Coldwind (ex-Google, Dragon Sector). Full engagement lifecycle: OSINT, initial access, persistence, command-and-control. Custom tooling built in-house — a C# multi-stage backdoor with registry-key persistence, Telegram-based C2, and anti-sandbox evasion. All techniques mapped to MITRE ATT&CK, delivered with a structured debrief.
§ VI — Network
Convening, writing, and collaboration.
Convening, writing, and pro bono engagements where the work serves a clear public interest.
Forum
Cyber Warfare 2026
Statecraft, Big Tech & Global Defense
WarsawJanuary 2026250+ participants
Keynote speakers
- Gen. Serhii Demediuk
former Deputy Secretary, NSDC of Ukraine - Dr. Łukasz Olejnik
King's College London - Aleksandra Wójtowicz
PISM
In cooperation with
- Vistula University
- Lviv Polytechnic National University
- Institute of Cyber Warfare Research
- Google Developer Group PJATK
War on the Rocks · 2026
Co-authored with Gen. Serhii Demediuk
“The classical understanding of state sovereignty is being challenged. States now must actively ask for permission to use private capabilities for defensive purposes.”
In support of
The 2026 forum supported Superhumans Center.
A Ukrainian organization providing medical rehabilitation for individuals injured during the war.
Engagement inquiries are reviewed individually
§ VII — Correspondence
Begin a correspondence.
We respond to every serious inquiry within two business days. Initial conversations are confidential and without obligation. Encrypted channels available on request.