About Baldur

Baldur Security is a Danish offensive-security consultancy. We break applications, networks and devices to find the vulnerabilities before attackers do. We work white box, with the source, because it finds more than probing from the outside.

We would rather hand you five findings that matter than fifty that do not. Every finding is one we reproduced, rated on real impact, and paired with a fix. That is the whole job: find the critical issues, prove they are exploitable, help you close them.

Track record

12+ years, around 33 CVEs, in software you know

The team has 12+ years in offensive security: 100+ penetration tests across sectors from banking to healthcare and the public sector, for organisations from 10 to 10,000 employees, plus 300+ bug bounty reports. Our public disclosures include vulnerabilities in Google Chrome, Fortinet, Mitel, PRTG, Nagios and F-Secure/WithSecure, up to and including unauthenticated remote code execution. All of it is subject to responsible disclosure. It is the clearest proof of how we test, and you can read the write-ups on our research page.

By the numbers
33CVEs published
100+penetration tests
300+bug bounty reports
OSCE / OSCPcertified
From exploit to boardroom

Deep on the wire, clear in the room

The work goes as deep as it needs to: reverse engineering, exploit chains, memory corruption. But a finding only matters once the people who need to fix it understand it. We write for both audiences, a management summary that states the risk in business terms and a technical report your engineers can act on line by line, and we present to the board and the security team without changing the facts between rooms.

Company

Details

Work with the people who wrote the exploits

A 30-minute call is enough to scope most engagements.

Book a scoping call