Independent vulnerability research

Beyond the
expected
path.

Security research that challenges assumptions, follows unintended behaviour, and turns findings into reproducible evidence.

Explore the research Start a conversation
FIG. 01A DIFFERENT VECTOR
A path that diverges from the expected behaviour A green line follows a grey horizontal route, then turns upward and crosses a trust boundary. A conceptual illustration of investigating unexpected behaviour. TRUST BOUNDARY EXPECTED PATH INPUT ASSUMPTION UNEXPECTED BEHAVIOUR
Follow the assumption.
Find the exception.

Question the assumption.

Demonstrate the impact.

Make the finding useful.

01 / RESEARCH

Curiosity, with
a technical purpose.

OffVector focuses on independent vulnerability research: understanding how vulnerabilities arise, proving their impact, and communicating what matters.

01

Vulnerability
discovery

Looking past intended behaviour to uncover broken assumptions, trust-boundary failures and overlooked attack surfaces.

Find the exception
02

Exploit
validation

Tracing a finding to its root cause and building a controlled proof of concept that makes the real-world impact clear.

Build the evidence
03

Coordinated
disclosure

Clear technical reporting through appropriate disclosure channels, with the emphasis on understanding and remediation.

Share what matters

02 / APPROACH

Less noise.
Better evidence.

A finding is only as useful as the reasoning behind it. The approach is deliberate: understand the system, test the assumption, and make the result reproducible.

Defined scope.
Controlled testing.
Clear communication.

01Understand the systemContext before conclusions.

Map the behaviour, identify the trust boundaries, and establish the permitted scope. Start with what the system is supposed to do.

SurfaceBoundariesScope
02Challenge the assumptionLook where expectations stop.

Explore unexpected states, edge cases and interactions. Follow the difference between the intended path and the actual behaviour.

Edge casesInteractionsHypotheses
03Prove the impactEvidence, not speculation.

Isolate the root cause and validate it through a controlled proof of concept. Document the prerequisites, the outcome and the limits of the finding.

Root causeProof of conceptImpact
04Make it actionableA finding that can be understood.

Prepare a concise technical report with reproducible steps and supporting evidence. Coordinate through the relevant vendor or programme disclosure process.

ReproductionReportingCoordination

03 / CONTACT

Good research starts
with a good question.

For research collaboration, vendor coordination
and vulnerability disclosure.

LET’S COMPARE NOTES

Direct contact. No forms.

Please start with a non-sensitive summary. A suitable channel can be agreed before sharing technical details.