Romain Carnus

Security vulnerabilities don't necessarily stem from a lack of tools, but from a lack of visibility into what can actually be exploited. Many organizations believe they are protected until the day an intrusion proves otherwise. My role is to simulate these attacks under real-world conditions, before a malicious actor does, to provide you with a clear, prioritized, and actionable view of your risks.

I am a consultant specializing in penetration testing and offensive security. I work on complex environments combining classic IT systems, Active Directory, web applications and APIs, as well as IoT, industrial systems, OT environments, and workstation audits. I cover both internal and external perimeters, with a business impact-oriented approach and attack scenarios adapted to your real context.

Throughout my missions, I have conducted Red Teaming and Purple Teaming operations, internal infrastructure audits, as well as in-depth source code and AppSec audit work. I also intervene upstream on security architecture and consulting to permanently address root causes. My work includes vulnerability research, including on low-level components.

Each mission is approached as a structured project, with clear scope, defined objectives, and regular communication. Deliverables are understandable for non-technical decision-makers while remaining actionable for operational teams.

I offer a turnkey, results-oriented service: clear and actionable reports, concrete exploitation proofs, and recommendations tailored to your maturity level. The goal is not to list vulnerabilities, but to durably reduce your attack surface.

If you want to assess your security level or challenge your defenses, let's connect via video call to define your needs. Quick response and pragmatic approach guaranteed.