Marin Cyber is a small offensive security practice based in Marin County, California. Every engagement is scoped and led by David Porcello: OSCP instructor, founder of Pwnie Express, and hands-on penetration tester since 2011.
Prompt injection, tool and agent abuse, data exfiltration, and the trust boundaries between the model and everything around it.
Authenticated and unauthenticated testing of web apps, REST and GraphQL APIs, business logic, and access control.
From perimeter assessment to assumed-breach internal access, lateral movement, and privilege escalation.
AWS, Azure, and GCP: identity and IAM abuse, misconfiguration, exposed services, and cross-account testing.
Domain enumeration, credential attacks, Kerberos abuse, ADCS, and paths to domain and enterprise admin.
Windows desktop applications: local storage, IPC and protocol analysis, and server-side trust assumptions.
iOS and Android: on-device storage, transport security, API back ends, and reverse engineering.
Firmware analysis, hardware interfaces, radio and wireless, and device-to-cloud communication.
Binary and protocol analysis to find what the documentation doesn't say, and to build reliable proof-of-concept exploits.
All pentesting engagements are handled directly by Marin Cyber and led by David Porcello. Testing is customized to your needs, whether that’s PCI DSS, SOC 2, HIPAA, ISO 27001, or internal requirements, and reports are written for the people who have to fix things. See service details
Large firms sell you a team and staff it with whoever is free. Marin Cyber is a senior practice with no bench to fill; the work is faster, the findings are better, and the rates are more reasonable.
No sales cycle, no scheduling queue. Most engagements go from first conversation to a delivered report in just a few weeks, with a 90-day retest window included standard with every engagement.
Testing follows OWASP standards. Every finding is validated by a real human and accompanied by clear reproduction steps, tangible business impact, and remediation that fits how your team ships.
David Porcello is an independent security researcher with 15 years of hands-on pentesting experience, OSCP instructor, founder of Pwnie Express, and creator of the award-winning Pwn Plug and other penetration testing devices featured in Wired, Ars Technica, and Mr. Robot.
Over the years, David has built covert hacking devices for DARPA, hosted workshops at Defcon, authored the Pentester’s Handbook, and built the tech behind NPR’s Project Eavesdrop.
More about DavidDrop us an email to get started. You’ll hear back from David directly, usually within a business day.
