Pillar 01
Offensive Security
Web, Mobile, API, Cloud, and AI systems. We find what scanners miss. Reports engineers can act on immediately.
Security overview
CWE-926CVSS 9.8
EndeScope — Security × AI × Engineering × Marketing
Offensive Security.Applied AI.Engineering.Marketing & Web.
A boutique for companies that want things attacked, built, marketed, and shipped. Pentesting, AI agents, software engineering, websites, and social media from one team. No checklist audits, no slide-deck consulting.
endescope@engage ~ %
$ ./engage --target client.tld --scope full $ agent.run(task="your workflow", model="claude-opus-4-7") $
Pillar 02
Applied AI
From use-case discovery to a production agent. Claude, OpenAI, open source. With evals, guardrails, and cost telemetry.
AI overview
claude-opus-4-7RAG
Pillar 03
Engineering
Software, hardware integration, cloud infrastructure, workflow automation. We build what you need, in the stack that fits your team.
Engineering overview
TerraformNext.js
Pillar 04
Marketing & Web
Websites, landing pages, social media, content systems, and marketing automation. We connect positioning, content, and technical delivery.
Start a marketing brief
WebAutomation
Security · ledger
- 50+
- actionable findings
- 12+
- engagements
- 9.8
- highest CVSS
AI · ledger
- 14+
- AI projects shipped
- 72%
- cache hit rate
- <1%
- hallucination rate
Services
What we deliver
Six security, four AI, four engineering, and four marketing/web offerings. Fixed scope, fixed price or retainer.
/ Security
- 01
Web App Pentest
Authentication, authorization, business logic, GraphQL alias and introspection abuse, session audits.
- 02
Mobile App Pentest
Android and iOS. Static and dynamic. TLS pinning bypass, exported-component audit, deep-link hijack, Frida hooks.
- 03
API Security Review
REST and GraphQL. Rate-limit bypass, IDOR, enumeration oracles, auth-flow audit.
- 04
Cloud Security Audit
GCP, AWS, Azure. IAM and service-account review, metadata-SSRF chains, exposed Cloud SQL, Secrets Manager, BigQuery access paths.
- 05
AI System Security
Prompt injection, jailbreak resistance, RAG data leakage, guardrail validation, tool-use sandboxing.
- 06
Red Team & Awareness
Fake-WiFi / rogue-AP, targeted phishing campaigns, USB drop, vishing, physical pretext. Measurable awareness tests for staff.
/ AI
- 01
Strategy Workshop
One to two days. Identify use cases, estimate ROI, choose architecture and vendor.
- 02
Custom Agents
Claude Agent SDK or Anthropic API. Tool use, prompt caching, clean integration with CRM, ERP, and ticketing systems.
- 03
RAG Pipelines
Ingestion, embeddings, retrieval tuning, citations, eval framework for relevance and hallucination rate.
- 04
Production AI Ops
Eval suites, drift monitoring, cost telemetry, latency budgets, A/B tests for prompts and models.
/ Engineering
- 01
Custom Software
Internal tools, web apps, APIs, dashboards. Full-stack TypeScript / Python / Go.
- 02
Hardware & IoT
Embedded systems, edge devices, firmware, BLE / Zigbee / LoRa bring-up, OTA updates.
- 03
Cloud & DevOps
GCP / AWS / Azure. Infrastructure-as-Code, CI/CD, monitoring, secrets management.
- 04
Workflow Automation
Replace manual processes with scripts, jobs, event pipelines, or AI-hybrid agents.
/ Marketing & Web
- 01
Websites & Landing Pages
Positioning, structure, copy, and technical delivery for websites, landing pages, and relaunches.
- 02
Social Media & Content
Content formats, editorial planning, posting workflows, and channel-specific execution.
- 03
Digital Marketing
Campaigns, performance content, SEO foundations, and measurable digital touchpoints.
- 04
Brand & Launch Support
Brand presence, launch communications, and the connection of design, content, and technology.
- 05
Marketing Automation
Content and publishing workflows, lead routing, campaign automation, and AI-assisted operations.
Process
How we work
Security
- 01Scopingstart
- 02Recon→
- 03Exploitation→
- 04Reporting→
- 05Remediation supportship
AI
- 01Discoverstart
- 02Design→
- 03Build→
- 04Eval→
- 05Operateship
Case Studies
Selected cases
Sanitized, methodology-focused, no client names without clearance.
SECURITYCVSS 8.1
Session-invalidation at a Tier-1 US marketplace
Refresh-token survives rotation, access-token survives logout. High-severity finding from a 36-hour engagement.
SECURITYCWE-926
Exported-component bundle in a food-delivery app
Six exported activities without caller verification, cross-app UI hijack demonstrable with a zero-permission PoC.
AIclaude-opus-4-7
Multi-agent orchestration for internal dev workflows
Electron desktop app with task routing, agent teams, and prompt caching. 3,700 LOC TypeScript, running in production.
AIRAG · eval
RAG pipeline for internal knowledge bases
Document ingestion, retrieval tuning with citation handling, eval framework holding hallucination under 1 %.
Active projects
What we’re building.
Products, systems, and automations from the current Endemine ecosystem.
Live
SaaSWeb App
Buchkram
A paperwork alternative for solo founders and growing teams.
Live
AstroAutomation
EndeNews
News CMS and automated publishing pipeline for Endemine.
Live
SaaSFintech
Arvekram
Lightweight accounting for Estonian OUEs, e-residents, and FIEs.
Live
MobileAIFirebase
TCGrail
AI-powered collection management, card scanning, and pricing for TCGs.
Ready for a real assessment?
Short scoping call, clear proposal, kick-off in two to four weeks.
Start the conversation