Pentest & offensive security
HDW Sec is a French company specializing in offensive and defensive cybersecurity. We conduct realistic penetration tests to identify exploitable vulnerabilities and provide a clear, prioritized remediation plan.
They trust us
To best ensure the cyber defense of companies and governments, our team offers a range of intellectual services to address concrete security challenges.
HDW SEC obtained the France Cybersecurity Label in January 2025 for its penetration testing, training and awareness offering.
This official label, awarded by an independent jury, attests to the quality and reliability of our services, in accordance with the demanding specifications established by the France Cybersecurity initiative.
Web, mobile, IoT, cloud or LLM: each domain has its own attack surface and methodology.
Your web apps and APIs carry business logic that an automated scanner cannot probe.
Find the flaws in your iOS and Android app before an attacker exploits them.
Before you ship, find out what an attacker can do with your connected device.
One over-permissive IAM role or an open bucket is enough to compromise your whole cloud.
Your LLM applications open an attack surface that your usual tests do not cover.
Penetration testing overviewWe simulate real attacks to identify exploitable vulnerabilities and strengthen the security of your systems.
Advanced attack scenarios combining physical intrusion, social engineering and cutting-edge offensive techniques to test your overall resilience.
Learn more
0-day research, IoT pentest and hardware hacking on your connected devices, embedded systems and industrial ecosystems.
Learn more
Development of custom offensive tools, vulnerability proof-of-concepts and offensive security research to stay one step ahead.
Learn more
Continuous dark web monitoring of your organisation's compromised credentials, with real-time alerts the moment they surface.
Learn moreTranslated from French
"To ensure a high level of security in our SaaS solutions, we trust HDW Sec. Their expertise and ongoing support allow us to offer our clients reliable, compliant and protected environments every day, with continuous monitoring for potential risks."
Didier SERRADEL
Founder, IDcapt
"Evolution Energie develops an energy trading software solution for large enterprises. Cybersecurity is a key driver in our development, and with HDW Sec we have found the right partner to meet these challenges."
Erwin Guizouarn
CEO, Evolution Energie
"HDW experts identified critical vulnerabilities and proposed pragmatic fixes. A concrete, fast impact on our security posture."
Marc Leroy
CTO, DataNova
Scanner de modules Drupal pensé pour le pentest. DrupEnum énumère les modules installés, identifie la version du core et remonte les vulnérabilités connues via OSV, là où Drupal n'avait pas son équivalent de WPScan.
Troisième vulnérabilité du Top 10 OWASP des LLMs, le Supply Chain ne concerne pas ce que votre IA dit, mais ce dont elle est faite : modèles, modules et bibliothèques récupérés un peu partout. Une centaine de modèles piégés ont déjà été trouvés sur Hugging Face, dont certains prennent le contrôle de la machine au simple chargement. Tour d'horizon des quatre maillons vulnérables, retour sur une mission d'audit chez un éditeur français, et les réflexes qui limitent le risque.
On penteste le web par réflexe, et on oublie le mobile. Retour d'audit sur une app de formation en entreprise : un simple deep link, hébergé sur le vrai domaine de la plateforme, suffit à voler le jeton de session et à prendre le contrôle du compte. La XSS, version mobile.
Get an estimate tailored to your scope and challenges.
