Independent penetration testing
Find out what an attacker would find. First.
Hands-on security testing, engineering and incident response, led by Max Vision: working with networks since 1980, publishing security research since the 1990s. Every finding is manually verified before it reaches you.
Services
What we test and fix
Scoped to what you actually run. Every engagement ends with findings you can act on, not a scanner export.
Web application & API testing
Authentication, authorization, injection, business-logic and session flaws, tested by hand against how your application really works.
Network penetration testing
External perimeter and internal network assessments: exposed services, segmentation, credentials and paths to what matters.
Source code review
Security-focused review of the code behind your product, with fixes explained in terms your developers can ship.
Incident response
Compromise investigation, cleanup and recovery, followed by closing the hole that let the attacker in.
Hardening & website security
Servers, hosting, WordPress, DNS and email authentication. Much of real-world security lives in how sites are run.
AI-assisted assessment
Expert-directed AI tooling for broader coverage, with a human verifying every result. Speed without the false positives.
Approach
Authorized, verified, discreet
Nothing is tested without written permission and an agreed scope. Findings are reproduced and proven before they are reported, so your team spends its time fixing real problems.
- Scope & authorizationWe agree on targets, timing and rules of engagement in writing before any testing begins.
- TestManual, expert-led testing, supported by tooling where it adds coverage.
- VerifyEvery finding is reproduced with proof of impact. No unconfirmed scanner output.
- Report & remediateClear priorities, concrete fixes, and hands-on help implementing them if you want it.
- RetestWe confirm the fixes hold.
About
Max Vision
Max started programming in 1980, at eight years old, on a Xerox CP/M machine, and came up through modems, BBSes, X.25 packet-switched networks and NSFNET as the commercial internet took shape.
Since then he has worked as a network planner, systems administrator, network penetration analyst, exploit developer and security engineer, including in a satellite operations control center, and ran his own practice and the whitehats.com security community, which published the arachNIDS intrusion detection database and widely cited worm analyses.
He was one of the original members of the Honeynet Project, whose early research ran on his intrusion detection signatures. He contributed to Snort, Nmap and the Bro IDS, and endorsed CVE as its identifiers were first being adopted across the industry.
Today he does security engineering, penetration testing and incident response, much of it white-label for partner firms, and works daily with AI-assisted security tooling.
- Starts programming on CP/M; modems, BBSes, X.25
- Network planning, systems administration, early web and ISP work
- whitehats.com, arachNIDS, original Honeynet Project member, CVE endorsement, Snort rules, published research
- MaxPenTest: testing, engineering and incident response
Public record
“The security community benefits greatly by using the CVE identifiers to enumerate vulnerabilities and exposures. The arachNIDS … includes CVE identifiers and is CVE searchable to allow users to quickly reference related security information in other CVE compatible databases and resources.”
Max Vision, founder of Whitehats/arachNIDS. Endorsements, CVE program archive (2000)
- Honeynet ProjectOne of the project's original members (archived members page)
- Know Your Enemy: A Forensic AnalysisHoneynet Project paper (2000) built on his arachNIDS signatures; thanks Marty Roesch and Max Vision “for their contribution to the security community”
- Honeynet Scan of the Month 13Featured write-up analyzing a real-world compromise from Honeynet capture data
- SANS GIAC: BIND 8 TSIG exploitIncident-handling paper citing his Snort signatures and BugTraq analysis of the 2001 BIND vulnerabilities
- arachNIDSSearchable intrusion event database cross-referenced to CVE, BugTraq and BlackICE, exporting signatures for Snort, Dragon, DefenseWorx, Pakemon and Shoki, with a community of third-party tools built around its rules. Sample entry: IDS110
- Max Vision Network SecurityHis earlier penetration testing and assessment practice (archived services page)
- Snort creditsCredited for ideas, debugging help and “lots of rules”
- Nmap changelogCredited for service fingerprint contributions (Nmap 3.40, 2003)
- Bro IDS & PrivmsgWrote Privmsg, which reconstructed IRC chats from network traffic for Honeynet research; its core became part of Bro (per Palo Alto Networks' Cybersecurity Canon)
- Ramen worm analysisTechnical analysis of the 2001 Linux worm
- Lion worm analysisFull technical teardown of the 2001 BIND-exploiting worm, including tracking down and interviewing its author (Honker Union of China), plus detection and recovery guidance
- Passive host fingerprintingPaper on identifying remote operating systems from passive traffic
- BugTraq disclosurePhorum 3.0.7 vulnerabilities with accompanying IDS signatures, 2000
- whitehats.com archiveThe site itself, as it stood in 2000
Max served federal sentences for computer crimes and was released in 2021. He has since completed supervised release, and his work today is entirely defensive: security engineering, incident response and hardening for businesses, much of it white-label through partner firms.
His cases were the basis for plots in the films Swordfish and Blackhat, and one of the hackers on the cyber “dream team” in Bill Clinton and James Patterson’s novel The President Is Missing is drawn from his case.
Contact
Start a conversation
Tell us what you want tested or what happened. A short description is fine; we'll follow up to scope it properly. Everything you send is kept confidential.
Or email info@maxpentest.com.