Security monitoring (SOC)
Monitoring and alert triage for organizations without an in-house SOC: one senior analyst, documented runbooks and clear escalation paths straight to me.
- Alert triage
- Runbooks
- Escalation
Available for remote engagements worldwide
I break inbeforeattackers do.
Independent blue team and red team services: security monitoring, threat hunting and incident response on one side, penetration testing and adversary emulation on the other. One consultant who does both.
Attack/Detection
- Who you work with
- Me, directly. No account managers.
- Working languages
- English, German and Persian
- Where your data lives
- On Google infrastructure, encrypted
- Before any access
- A signed NDA and rules of engagement
Defensive operations
Blue team services
Detection, response and resilience. I watch your environment, hunt what slips through and stand next to you when it counts, with the same hands that attack systems for a living.
Incident response and DFIR
When a breach happens, minutes matter. Rapid containment, forensic analysis and eradication, followed by a lessons-learned report that makes the next attack survivable.
- Containment
- Forensics
- Recovery
Threat hunting
Hypothesis-driven hunts across endpoints, identities and logs, informed by current threat intelligence, to find the compromises your automated alerts never caught.
- Threat intel
- Hypothesis-driven
- IoC sweep
SIEM engineering and hardening
Design, deployment and tuning of SIEM pipelines on Splunk, Elastic or Wazuh, plus system hardening aligned to CIS Benchmarks, so the logs you collect are logs you can use.
- Splunk / Elastic / Wazuh
- Detection rules
- CIS hardening
Offensive operations
Red team services
I think, move and persist like a real adversary, so your first real breach happens in a controlled environment and not at 3 a.m. on a production system.
Penetration testing
Web applications, internal and external networks, mobile and cloud environments (AWS, Azure), tested manually against OWASP, PTES and OSSTMM methodologies rather than by automated scans alone.
- Web and API
- Network
- Cloud
- Mobile
Adversary emulation
Full-scope, objective-driven attack campaigns that replicate real APT tradecraft. Every technique is mapped to MITRE ATT&CK, so you see how far an intruder would get.
- MITRE ATT&CK
- APT tradecraft
- Full scope
Social engineering
Realistic phishing, vishing and pretexting campaigns that measure how people respond, with per-department results and awareness training where it matters most.
- Phishing simulation
- Vishing
- Awareness
Purple team exercises
Collaborative attack-and-detect sessions with your defenders. Each offensive technique becomes a tested, tuned detection rule your team keeps.
- Detection tuning
- ATT&CK coverage
- Workshops
How I work
Five steps, every engagement
A one-week audit and a year-long retainer follow the same operating rhythm.
01
Scope and recon
We define objectives, rules of engagement and your threat profile together. No surprises, full transparency from day one.
02
Execute
Attack simulation or continuous monitoring, carried out manually and with constant communication.
03
Detect and measure
Every technique is measured against your defenses: what your controls caught, what they missed, and why.
04
Report and debrief
An executive summary for the board and a technical deep-dive for engineers. Every finding is prioritized and comes with a working fix.
05
Remediate and retest
I verify every remediation with a retest, so closing the report means closing the risk.
Frameworks I operate on
- MITRE ATT&CK
- OWASP
- PTES
- OSSTMM
- NIST SP 800-115
- CIS Benchmarks
- ISO/IEC 27001
Engagement models
Three ways to work together
Clear engagement models instead of vague consulting budgets. Pick the depth you need today and scale when the threat does.
Security audit
For SMEs that need a clear, honest picture of their exposure.
€1,900from, one-time
- Vulnerability assessment (1 target)
- External attack-surface scan and manual review
- Executive summary report
- 60-minute debrief call
- One retest after remediation
Recommended
Full assessment
The deep-dive: attack and defense under the microscope.
€4,900from, per engagement
- Full penetration test (web and network)
- Social engineering campaign (phishing simulation)
- MITRE ATT&CK detection-coverage mapping
- Technical and executive reporting (EN/DE)
- 30-day retest window and remediation support
Enterprise partner
Offensive and defensive security on demand, on one monthly retainer.
Custommonthly retainer
- Dedicated offense and defense retainer
- Security monitoring and incident-response support
- Quarterly adversary-emulation exercises
- Continuous hardening and security advisory
- Response times defined in an agreed SLA
Prices are indicative. Every engagement is scoped individually, and the final quote depends on scope, targets and complexity.
Who you work with
Run by a practitioner, not a sales deck
Mohammad Amjadi
Cybersecurity analyst: SOC operations and penetration testing
Pentest2 is my independent one-person practice. You work directly with me, from the first scoping call to the final retest.
I built it on a simple conviction: real security comes from doing both sides, understanding how attackers get in and making sure defenders see them coming. The person who attacks your systems also helps you defend them, so nothing gets lost between offense and defense.
- Direct specialist access
- No juniors and no account managers. Every operation is run by the person you meet on the first call.
- Remote, worldwide
- I work remotely with clients in any region. Every engagement is handled under GDPR-level data protection by default, wherever you are based.
- Reports in English or German
- Engagements, briefings and reports are delivered in whichever language your stakeholders read.
- Framework-driven method
- MITRE ATT&CK, OWASP, PTES and NIST: a structured methodology you can present to auditors and management alike.
- Actionable reporting
- Every finding ships with reproduction steps, business impact and a working fix. No 300-page PDFs nobody reads.
- Honest risk ratings
- No inflated scores and no fear-based upselling. Findings are ranked by real business impact, including what you don't need to fix.
Compliance and trust
Privacy laws and international standards
Security work without legal discipline is just risk with extra steps. Each engagement is designed to support your compliance posture in the regions where you operate.
Data protection across the EU and EEA.
- GDPR
- Data protection and privacy for natural persons
- NIS2
- Cybersecurity risk-management directive for essential and important entities
- DORA
- Digital operational resilience for the financial sector
- TISAX
- Automotive industry information-security assessment (ENX)
Standards I align with
- ISO/IEC 27001
- ISO/IEC 27002
- SOC 2
- PCI DSS 4.0
- NIST SP 800-115
- CIS Controls
- MITRE ATT&CK
- OWASP ASVS
- IEC 62443
How I handle your data
- NDA and rules of engagement signed before any access
- Client data stored on Google infrastructure, with access restricted to me
- Encrypted in transit (TLS) and at rest on all devices
- No sharing with third parties
- Engagement data deleted or returned at project end
- Anonymized reporting available on request
Pentest2 aligns its methodology, contracts and data handling with the frameworks listed above to support your compliance program. I am not a certification body and nothing on this page is legal advice. Formal certification (ISO, SOC 2, TISAX) is issued only by accredited auditors.
Questions
Before you get in touch
What is the difference between a penetration test and adversary emulation?
A penetration test looks for as many exploitable weaknesses as possible in a defined target, such as a web application or a network segment. Adversary emulation pursues one objective the way a real attacker would, across people, processes and technology, and measures whether your defenders notice. Most organizations start with a penetration test.
Do you need written authorization before testing?
Yes, always. Every engagement runs under a signed contract, an NDA and explicit rules of engagement. I only test what you authorize in writing.
Will testing disrupt our production systems?
Testing windows, off-limits systems and any technique that carries an availability risk are agreed in the rules of engagement before work starts, and you have a direct line to me throughout.
What do we receive at the end of an engagement?
An executive summary for management and a technical report for engineers, in English or German. Each finding includes reproduction steps, business impact and a fix, followed by a debrief call and a retest once you have remediated.
Where is our data stored, and what happens to it afterwards?
Client data is stored on Google infrastructure, encrypted in transit and at rest, with access restricted to me. At the end of the project it is deleted or returned to you.
Does a penetration test make us ISO 27001, NIS2 or TISAX compliant?
No. My work supports your compliance program with evidence and remediation, but I am not a certification body and nothing here is legal advice. Formal certification is issued only by accredited auditors.
How is pricing determined?
The prices shown are indicative starting points. Every engagement is scoped individually, and you receive a fixed-price quote once the scope, targets and complexity are agreed.
Get in touch
Ready to test your defenses?
Tell me where it hurts. A 30-minute consultation is free and comes with no obligation.
Location
Remote, worldwide
Response time
Usually within one business day
What happens after you write
- 1. A scoping call at a time that suits you
- 2. Draft rules of engagement and an NDA
- 3. A fixed-price quote once the scope is agreed