About
Byteshark is an independent security research lab. It builds autonomous tooling for offensive and defensive work, keeps a human on every call that matters, and publishes the research in the open.
Most security work is volume.
Enumeration, triage, correlation, the hundredth sample that looks like the ninety-ninth. Byteshark builds harnesses to carry that volume and leaves the decisions to a person. What happened gets published with the evidence attached, so anyone can check it.
Attacks are easier to defend against once someone has shown exactly how they work. That was the reason the lab started, and it still is.
Four areas.
- Adversary emulation: pointing an autonomous agent at an authorized target and documenting what it manages to do
- Malware reverse engineering: unpacking samples until the logic is clear
- Threat intelligence: campaigns, infrastructure, and the actors behind them
- Hardware hacking: opening up devices and documenting what’s inside
Mako — autonomous adversary emulation. Closed beta. What Mako is →
More is in the works. Nothing is announced until it has done the job.
Focus: adversary emulation, malware reverse engineering, threat intelligence, hardware hacking
Background: hands-on experience in authorized penetration testing, threat hunting, threat intelligence, and offensive security
Reports: read, checked, and signed by a person before they leave the lab
Four things that don't bend.
Independent.
The lab chooses its own questions and answers to no vendor. The research is not shaped by the product.
Evidence first.
Findings come with the evidence so readers can check them. A model’s claim is not a finding until a human has verified it.
Consent first.
Byteshark only works on systems and organizations that have authorized it in writing.
Plain language.
Hard topics explained clearly, with no fear tactics.
Common questions.
Is Byteshark an MSP?
No. No managed IT, no monitoring, no retainer you cannot leave. Byteshark does scoped engagements and publishes research.
Is Byteshark a product company or a research lab?
A research lab first, and a penetration testing firm. It builds its own tooling and offers it as a service. The tooling is closed source; the research about building and running it is public. The rules every engagement runs under are on the Security page.
Will my project get published?
Only if you approve it in writing. Work is confidential by default, and anything published is fully anonymized.
What does it cost?
Commissioned projects are scoped individually and quoted after the intro conversation, which is free. Mako beta engagements are at no cost for accepted applicants. Capacity is limited, so projects are accepted selectively.
How are projects delivered?
Remotely. Scope and authorization are agreed in writing up front, and the report comes with a walkthrough.
Follow the research, or bring Byteshark a problem.
Mako is in closed beta, and a limited number of commissioned projects are taken on when they fit the lab’s focus areas.