Security people, not a sales pipeline.
Hozaked is a small, deliberately focused consultancy. You talk to the person who runs the tests, reads your code and writes your report — not to an account manager who forwards your questions to someone else.
A French security expert who genuinely loves the craft
Hozaked is led by a French cybersecurity specialist with 7 years of hands-on experience across both sides of the discipline: offensive work — penetration testing, red teaming, exploit development — and defensive work, hardening the systems that had just been broken.
That double perspective matters. Knowing how an attack actually lands is what separates a finding that gets fixed from a finding that gets filed away. And having sat on the defensive side means recommendations arrive as something your team can realistically ship, not an idealized checklist written by someone who never had to maintain the system.
The move into AI and LLM security was not a pivot chased for the market — it came from genuine curiosity about a class of systems that breaks in ways the existing playbook does not cover. Prompt injection, tool abuse, agent chains that quietly escalate their own privileges: these are new problems, and they deserve people who find them fascinating rather than merely lucrative.
At a glance
- 7 years in offensive and defensive cybersecurity
- AppSec & penetration testing as the technical foundation
- LLM and agentic systems as the current specialization
- Banking, film and insurance clients served
- Direct access to the practitioner, start to finish
Industries with real consequences
Sectors where a security failure is measured in regulatory exposure, leaked intellectual property or breached customer trust — not in a support ticket.
Banking
Environments where every finding is weighed against regulatory obligations and audit trails, and where a proof of concept has to be reproducible on demand to be taken seriously.
Film & entertainment
Production pipelines where unreleased content is the crown jewel, and where the threat model is as much about leaks and insider access as it is about external intrusion.
Insurance
Large volumes of sensitive personal data spread across legacy systems and modern applications, where the hard part is often the seam between the two.
On client names: we describe sectors, never clients. Engagement details stay confidential unless a client explicitly agrees in writing to be referenced — and we will tell you the same thing about your own audit.
Transparency, then follow-through
Two commitments shape every engagement — and both exist because their absence is the most common complaint we hear about previous providers.
-
A scope you can read
Before anything starts, you get a written scope: what will be tested, what explicitly will not, the methods used, the timeline, and the price. No open-ended day rates that quietly expand.
-
No surprises mid-engagement
If we find something critical on day one, you hear about it on day one — not in a report three weeks later. Anything that changes the scope is discussed with you before it happens.
-
A report your team can act on
Every finding comes with a reproduction path, a risk rating (CVSS) and a concrete remediation. Written to be handed straight to the engineer who will fix it.
-
Full follow-up, when you need it
A report is not the end. We stay reachable to answer questions while your team implements fixes, review proposed patches, and re-test remediated findings to confirm they are genuinely closed.
What we will not do
Being clear about the limits is part of being trustworthy. So, plainly:
- We will not promise that a system is "100% secure" — nobody can.
- We will not pad a report with low-value automated scanner output to make it look thorough.
- We will not take on an engagement we are not the right fit for; we will say so and point you elsewhere.
- We will not use your name or logo as a reference without your written agreement.
Want to know if we are a good fit?
Tell us what you are building and what worries you about it. If we are not the right people for the job, we will say so.