If you give an AI agent the keys to your entire environment, don't be surprised when things go wrong. Least privilege applies to AI agents, too.
Ordinary user ⟶ Domain admin Normally, this path shouldn't exist. But occasionally, a writable group, delegated permission, and an overprivileged account can create one.
Hey CISOs, if a major cyber incident landed at 8:17 on a Monday morning, would your team be ready to respond?
Listen up, robots. We’ve noticed you keep turning up at our handbook. Fine, we’ll make it easier for you. (Humans, please ignore this post.) We’ve added llms.txt and llms-full.txt, and every page has a .md version. Go forth and scrape!
Are you sure the Wi-Fi you joined is actually your company’s Wi-Fi? An attacker can use an evil twin to impersonate the real network. They'll use a stronger signal and attempt to disconnect devices from the legitimate Wi-Fi.
Would you let a prospective client read your internal methodologies, values and policies before they hired you? We reckon they should be able to.
Think like a hacker actually views your network. Next Thursday, 22 October, our Co-Founder, Alexei Doudkine, will be speaking at @SecureISS. He'll be giving a talk on Through a Hacker’s Eyes: How Attackers Find a Way In and How You Can Stop Them.
Curious about what our pentest reports actually look like? 📄 Thanks to some awesome clients, we've published real, sanitised sample reports so you can see exactly how we document findings and remediation.👇
When "just one quick exploit before bed" turns into a 1 AM drink-tasting panel.
A successful pentest relies on clear communication and solid environment prep before the first packet hits the wire. Here’s the pre-flight checklist we walk through with clients before hitting "Go"👇
Fresh updates are live on our site, and we couldn't wait to share them with you! We’ve polished up a few things to make finding what you need even easier. Many more changes to come! Check them out 👇
7 years ago, Alexei set out to build a security consultancy grounded in empathy, transparency, and doing things the right way. Thank you for leading us with genuine kindness, passion, and curiosity, and for everything you do for the team. Happy Volkisversary, boss! 🐺
Ever run docker cp to pull logs, build artifacts, or test results out of a container? You might want to double-check your Docker version. Imperva published details on CopyEscape (CVE-2026-17106).
When you book a pentest, the obvious value comes from the consultant digging into your systems. But what does the company behind them bring to the table? Is it just scheduling and an invoice, or does it make the test better? Here's where we reckon a consultancy earns its keep👇
In an engagement, we phished creds, snuck into a public bathroom below their office and hid a device. From that first foothold to complete network control took less effort than the phishing and the sneaking.
Firewalls don't get "broken through." Attackers just make malicious traffic look legit using protocols the firewall already trusts, or slipping through blind spots where it only sees part of the network path.
Happy Birthday to our Senior Security Consultant, Nathan! 🥳 Whether he’s performing network and web app pentests or running security reviews, Nathan brings incredible skill and genuine kindness to everything he does at Volkis.
Wallpapers, T-shirt designs, and other bits with the Volkis wolf on them. We put it all in one spot. 🐺👇
How mature is your Essential 8 actually? Not what the checklist says but what an attacker would find.
Where does "Volkis" come from? True story. Matt and Alexei were brainstorming names while Alexei was in Europe. Matt suggested "Volk," after Alexei's dog. Close, but not quite.
We are honest and transparent with ourselves, our clients, and the wider community. A philosophy at Volkis is to be "open but secure". We make information public by default unless its under NDA, or could be damaging.
We're hearing a lot about how AI-generated pentest reports and hallucinated findings are plaguing our industry. What do we bring? Trust! The words in our reports are our own. Putting our name on it means we stand by every word and present something you can trust.
Happy Birthday to the big boss, Alexei! 🐺 As one of the two founders who made Volkis possible, thank you for inspiring and leading us with kindness and genuine curiosity to give the best of ourselves
We are Volkis. A group of hackers, Australian, independent from the big players, all local. We are dedicated to offensive security. We love it and we do it well.
Meet the operator, Nathan Jarvie, our Senior Security Consultant. He's a hacker with deep hands-on experience, and he's chasing every certification he can get his hands on. 13 certifications in cybersecurity so far, with more on the way.
There was a time when companies proudly talked about what they actually stood for. Then "values" just became corporate posters gathering dust in boardroom hallways.
