A boutique security consultancy. We test the way an adversary would, across the physical and the digital together, then build the capability that outlasts the engagement.
Network and physical security are run by different teams, and what is deployed drifts from what the documentation says. We read the whole estate as one surface, the way an adversary does.
We find the alarm panel that sits on the corporate VLAN, the executive whose home address appears in a public filing, and the vehicle tracker still on its default credential. The routes in red are the ones an adversary would walk: over the wall and up the facade, then in through the front door.
We report the few things that would be used against you and fix them in order. The routes are closed and the findings retested, and what we build has to run without us.
Most clients start in one area and find that it connects to the others.
We attack your organisation the way a motivated adversary would, then hand you the map they would have used.
Networks, systems and devices designed so that a single compromise is contained where it starts.
Discreet protection for people, vehicles and premises, planned by people who also understand the digital attack surface attached to them.
Reconstructing what actually happened on a compromised estate or device, or inside your own organisation.
Close protection and close quarters capability across land, sea and air, planned by one team as a single continuous task.
We do not run a 24/7 SOC or resell licences, and we will not bid for work that needs a capability we do not hold. We keep to a narrow set of things and do them properly.
These are the same figures we put in front of clients. Drag a wireframe to orbit it, and select any marked feature to read what it exposes.
A · Huracán Performante
B · 812 N-Largo
C · Brabus 800 (G 63)
| Spec | A | B | C | Note |
|---|---|---|---|---|
| Length | 4,506 mm | 4,657 mm | 4,873 mm (incl. tailgate spare) | C longest · +367 mm on A, +216 mm on B |
| Width | 1,924 mm | 2,110 mm (rear arches) | 2,084 mm (Widestar flares) | B widest at the arches · C +100 mm on its 1,984 mm body |
| Height | 1,165 mm | 1,241 mm (−35 mm springs) | 1,966 mm | C stands ~0.8 m over both · optional RideControl −45 mm |
| Wheelbase | 2,620 mm | 2,720 mm | 2,890 mm | C +270 mm on A, +170 mm on B |
| Engine & layout | 5.2 L V10 · mid-rear · 640 PS | 6.5 L V12 · front-mid · 840 PS | 4.0 L V8 biturbo · front · 800 PS | C the only turbocharged, front-engined, ladder-frame vehicle of the three |
| Drive | AWD | RWD · 4WS | AWD 40:60 · 9-spd · 3 locks · low range | A and C AWD · B alone RWD |
| Dry weight | 1,382 kg | 1,525 kg (base) | 2,485 kg kerb (stock G 63) | C quoted at kerb weight · Brabus 800 kerb unpublished · ≈ +1.0 to 1.1 t on A/B |
| Tyres | 245/30 R20 · 305/30 R20 | 275/30 R21 · 335/25 R22 | 305/35 R23 · 305/35 R23 | C 35-series carries ~107 mm of sidewall vs B’s ~84 mm |
| Keyless | 125 kHz LF · relayable | Keyless start · 125 kHz LF · 433 MHz fob | Keyless-Go entry + start · 125 kHz LF · 433 MHz fob | Relay opens and starts C · only inside the key’s ~2 min awake window |
| Factory telematics | None (2017 to 2019) | None (2017 to 2020) | LTE module · Mercedes me connect (MY2019+) | C carries a factory uplink · remote unlock and live tracking |
| OBD-II location | Under dash · door aperture | Under dash · OBD bracket | Under dash · driver footwell | Parity on placement · FBS4 blocks OBD key programming on C |
| Tracker fit | Covert aftermarket unit | Covert aftermarket unit · Thatcham S5 | Covert aftermarket unit · Thatcham S5 | Parity · C’s factory Vehicle Tracker shares the LTE module a thief pulls first |
It holds their messages, movements, contacts and the keys to most of the accounts they use. It is also the most exposed device they carry, connected all day and regularly out of their hands. We assess that exposure in advance, and examine the handset after an incident.
Configuration, apps, linked accounts and paired devices reviewed against how the principal uses the phone, and hardening agreed with them so it stays in place.
A suspect phone is checked with the owner’s consent, before anything is removed, and the result names the indicator sets and the date of the check.
Each extraction is the fullest the device state allows and is corroborated in a second tool. Analysis gives a timeline with evidence attached to each step.
We establish what a lost or seized handset gives up in the state it was in, and which accounts and sessions to revoke first.
We test mobile apps for how they store and transmit data, and check MDM policy and BYOD boundaries against how staff use their phones.
Findings are stated at the level the evidence supports and no further. Method and tool output are documented so another examiner can check every conclusion.
The team works in these tools and checks findings in more than one of them. Naming a tool here implies no partnership or endorsement.
Real engagements, written up in full, from the brief to what changed afterwards. Every case is anonymised, and stays that way whether or not the client would mind.
The client commissioned four workstreams across family, residence, business and digital footprint. We audited them as one attack surface, because that is how an adversary reads it.
A thirty-two day extortion campaign across three social platforms, ending in the takeover of the client’s primary brand account, and a recovery that had to work around a moderation system actively assisting the attacker.
A routine consultation surfaced a second, internal threat: a former supplier whose technical access had never been revoked, and who had already used it. What began as an access-hygiene finding was, by the end of the audit, an active incident.
Security consultancy has a credibility problem, and it is largely self-inflicted: unverifiable claims, reports optimised for length, and findings that arrive too late to act on. The six stages below are how we avoid them.
A conversation about what you are actually worried about, which is often not what the enquiry said. There is no charge and no obligation.
Written scope, rules of engagement, and authorisation from someone empowered to give it. Work does not begin without it.
Executed by the people who scoped it. Anything critical is escalated by telephone the moment it is found, without waiting for the final report.
Two documents: an executive summary a board can act on, and a technical report your engineers can use to reproduce and verify every finding themselves.
We walk your team through the findings, help prioritise against the resources you have, and stay reachable while the work is done.
We retest the findings, so no fix is assumed to work until it has been verified. Retesting is included as standard on assessment engagements.
Every finding we issue answers six questions, in this order, because a finding that stops at the first two is not actionable.
Severity is assigned on exploitability and business impact together. A medium-severity issue forming the second link in a working attack chain outranks an unreachable critical, and our reports say so.
The anatomy of a finding
Each programme’s syllabus, lab environment, exercise library and assessment are written from a blank sheet against the capability you need, and nothing is licensed from a catalogue and rebranded. The measure of success is that the programme runs without us.
A multi-phase programme that takes technically capable people to working red team operator standard, built from a blank sheet and delivered to national-level cohorts.
Practical workshops for defensive teams covering threat intelligence and advanced detection engineering, taught in the SIEM your analysts use.
For organisations that need a standing training function built from nothing, with its own syllabus, lab, exercise library and assessment.
The groundwork offensive and defensive training both assume and rarely teach: how networks actually behave, and why that determines what is possible on them.
If a supplier is showing you someone else’s engagement, assume they will show yours.
Ongoing relationships across national government, UK financial services, defence and professional services, named here with permission. Everything about the engagements themselves stays confidential.
Not every client appears here. Protective work for private individuals is never referenced publicly, and several engagements cannot be named at all.
The frameworks these engagements run under. This is methodology alignment and delivery experience rather than a claim of accreditation held by this firm.
The gap we kept finding was that nobody owned the whole picture. Network security is procured by IT and physical security by facilities or a family office. Neither party reads the other’s report, and the failures we find sit in the space between them.
GHOSTHUNTER was founded to assess that space as one problem. It is why our service lines look unusual next to each other: offensive testing and protective operations are rarely sold by the same firm, and adversaries exploit that separation.
Staying small is a deliberate choice, and we do not intend to grow out of it. It means the people who scope your engagement deliver it, and that we can decline work we are not right for.
Initial discussions are confidential and carry no obligation. If we are not the right fit for what you need, we will tell you and point you somewhere that is.
Answered by a person, usually within one working day · No sales sequence or automated follow-up
Live incident? Telephone rather than email: your mail may be monitored by whoever is in your environment.