Proactive cybersecurity · Offensive security research · Rome, Italy
Find structural weaknesses before attackers do.
Hellebore Security specialises in proactive cybersecurity, offensive security research and the advanced protection of critical infrastructure. We help complex organisations and industrial ecosystems identify and mitigate structural vulnerabilities before malicious actors can exploit them.
- ├─scopephase_1
- ├─planphase_2
- ├─testphase_3
- ├─reportphase_4
- └─retestphase_5
Our specialism
Offensive security for medical devices and IoT
In healthcare and connected systems, protecting data and the integrity of devices directly affects the continuity of essential services. That is where we focus our deepest work.
Medical Device Security
Offensive security testing of medical devices and their ecosystems: hardware, firmware, wireless links, companion apps and clinical integrations.
- Device hardware, debug interfaces and firmware
- Wireless and wired interfaces (BLE, Wi-Fi, USB, proprietary links)
- Companion mobile apps, cloud services and update mechanisms
IoT & Embedded Device Security
Assessment of connected devices, from circuit board and firmware to radio interfaces and companion apps.
- Hardware debug interfaces (UART, JTAG, SWD) and storage extraction
- Firmware analysis, secure boot and update mechanisms
- Wireless protocols: BLE, Wi-Fi, Zigbee, LoRa and sub-GHz
Capabilities
From application security to complex networks
Our core expertise ranges from application security to complex network architectures. Each engagement is scoped to the risk you actually need to understand.
Application Security Assessment
In-depth testing of web, mobile and desktop applications, including business logic and authorisation flaws.
Network & Infrastructure Penetration Testing
Manual, adversary-minded testing of complex network architectures, from the internet-facing perimeter to internal segments and Active Directory.
Red Teaming & Adversary Simulation
Goal-driven, multi-vector simulations that test your detection and response, not just your defences.
Cloud Security Assessment
Configuration reviews and attack-path analysis for AWS, Azure, Google Cloud and Kubernetes.
Security Code Review
Manual, risk-focused review of source code to find vulnerabilities that testing alone can miss.
Security Advisory & Consulting
Pragmatic guidance on architecture, threat modelling, secure development and EU regulatory readiness.
Incident Response Readiness
Preparation, playbooks and tabletop exercises so your team knows what to do when something goes wrong.
Not sure where to start?
Tell us what you need to protect and we'll suggest a scope.
Talk to usHow we work
From scoping call to verified fix
A structured, transparent process, from the first scoping call to retesting your fixes.
- 01
Scope
We start with a conversation about your goals, environment and constraints, then propose a scope and effort estimate. No templated quotes.
- 02
Plan
We agree rules of engagement, testing windows, points of contact and safety measures in writing before any testing starts.
- 03
Test
Hands-on, manual testing guided by public methodologies and adversary thinking. Critical issues are reported immediately, not at the end.
- 04
Report
A clear report with an executive summary, reproducible technical findings and prioritised remediation, followed by a walkthrough call.
- 05
Retest
Once you've fixed the issues, we verify the fixes and update the report so you have a clear record of closure.
Industries
Focused on high-risk sectors
We work where cyber resilience is an operational requirement, not a nice-to-have: healthcare and medical technology, critical infrastructure and the industrial ecosystems around them.
Why Hellebore
A young firm, with a clear point of view
Founded in early 2023 in Rome, Hellebore Security is still a young company. We won't show you a wall of logos or inflated numbers. What we offer instead is direct access to the people doing the work, careful methodology, and reports that respect your time.
Every engagement is led personally, scoped honestly, and delivered with the same rigour whether it's a two-day test or a multi-week simulation.
Research & insights
Coming soonWe plan to publish technical write-ups, advisories (following coordinated disclosure) and practical guidance here. The first articles are in preparation.
Let's talk about what you need to protect.
Tell us a little about your environment and goals. We'll reply with questions, a suggested scope, or an honest note if we're not the right fit.