Skip to content
Edictum Labs, home
Services

Research-led
security services

Five disciplines, held to one standard: understand the system well enough to say something true about it, then prove it. Engagements are shaped around your systems and your risk.

Disciplines
Research · Testing · AI · Cloud · Engineering
Based in
Prague
Disciplines

Where to start.

01

Vulnerability Research

Find the flaw before an adversary writes the exploit.

Sustained, curiosity-driven investigation into how software and systems break — from kernel memory handling to isolation boundaries — grounded in executed evidence rather than theory.

  • Operating-system and kernel security
  • Memory corruption and memory safety
  • Virtualization and isolation boundaries
  • AI inference systems and native execution
  • Security architecture and trust boundaries
  • Implementation-level defect analysis
02

Penetration Testing

Authorized assessment with the depth of real research.

Scoped, consent-based engagements for organizations that need serious technical investigation — not a scan report. Every finding is reproduced, explained, and tied to concrete impact.

  • Web applications and APIs
  • Cloud and infrastructure
  • Kubernetes and container platforms
  • AI agents and LLM applications
  • Authentication and authorization systems
  • Remediation validation
03

AI Security

Measure what an AI system can actually reach.

Assessment of agents, LLM applications, and inference stacks as execution surfaces — tool and data boundaries, authorization between agents and services, and the native code behind modern inference.

  • Agent and tool-execution boundaries
  • LLM application security
  • Inference runtimes and native code
  • Model-serving infrastructure
  • Agent, tool, and data authorization
  • Model and extension supply chain
04

Cloud & Infrastructure Security

Find the identity that quietly owns everything.

Assessment of cloud accounts, Kubernetes platforms, and the infrastructure that deploys them — privilege paths, workload isolation, and the trust placed in managed services, proven from a realistic foothold.

  • Cloud IAM and privilege-escalation paths
  • Kubernetes and container platforms
  • Workload, tenant, and account isolation
  • Infrastructure-as-code and configuration
  • CI/CD and deployment-pipeline trust
  • Service-to-service authorization
05

Security Engineering

Remove the weakness, not just the symptom.

Work with your engineers to understand and eliminate the underlying causes — design flaws, unsafe assumptions, inadequate authorization, missing validation, and incomplete fixes.

  • Threat modelling and trust-boundary review
  • Secure design and architecture guidance
  • Authorization and access-control design
  • Fix verification and defect-class elimination
  • Security review of critical software
  • Hardening and defensive engineering
Security engineering

Remove the weakness, not just the symptom.

Finding issues is only half the work. The other half is making sure they do not come back — by eliminating the underlying cause.
  • Threat modelling and trust-boundary review
  • Secure design and architecture guidance
  • Authorization and access-control design
  • Fix verification and defect-class elimination
  • Security review of critical software
  • Hardening and defensive engineering
How it works

Engineering a fix that holds.

01

Find the real cause

A finding is a symptom. We trace it to the design decision or unsafe assumption that produced it — the authorization that was never enforced, the input that was never validated, the invariant nobody wrote down.
02

Design the fix with you

We work alongside your engineers rather than handing over a document. The goal is a fix they understand and own, not a recommendation that sits in a backlog.
03

Close the class

Where a bug represents a pattern, we help eliminate the pattern — so the next variant never ships, and the fix holds under the cases a narrow patch would miss.
04

Verify it holds

We confirm the boundary actually enforces what it is supposed to, against the original issue and its neighbours. A fix is not done until it is proven.
Engagement model

Senior work, directly.

No layer of account managers between you and the person doing the research.

Edictum Labs is a small, senior practice by design. The person scoping your engagement is the person doing the work. That keeps the signal high and the overhead low.

Engagements are bounded, authorized, and documented. We are honest about what deep work is worth doing — and when a lighter approach would serve you better.

Engagements

Bring us the system you’re least sure about.

Vulnerability research, an authorized assessment, or a second opinion on a fix you are not confident closed the issue. Tell us what you need examined.

Reply
Within two business days
Authorization
Written, before any testing
Based in
Prague, Czech Republic