Penetration testing and offensive security
SFL Testing LLC delivers manual, evidence-based penetration testing across networks, applications, cloud, AI systems and people, for organizations of every size and sector. Every engagement ends with a report your engineers can act on and your leadership can read.
Experience across sectors
Healthcare, insurance, education, government and many others. Every environment is different, and every engagement is scoped to fit it.
Full-scope offensive security. This list is a starting point, not a limit.
Tell us what you need tested. We scope custom engagements for environments, products and threat models that do not fit a standard category.
AI features add attack surface that traditional testing does not cover. We test it the way an attacker would.
An AI system is an application with an unusual component: a model that follows instructions found in the data it reads. We assess the whole system, including the model, the prompts, the tools and data sources it can reach, and the application code and permissions around it.
A defined sequence, so you know what happens and when.
We agree on targets, testing windows, off-limits systems and emergency contacts, and we receive written authorization before any testing begins.
Asset discovery and fingerprinting within the agreed scope.
Every finding is verified by hand. Scanner output alone is never reported as a result.
We demonstrate real business impact using the least access required, then stop.
Findings are scored, documented with evidence and paired with specific remediation guidance.
Once you have fixed issues, we verify the fixes and update the report. Retesting is included.
Reports are written for two audiences: the engineers who fix the issues and the leaders who fund the fixes.
Our testing is informed by ongoing, independent security research.
We study how emerging technology, including large language models, changes both attack and defense, and we apply that research directly to client engagements. Our work has been presented to the security community at BSides Charlotte.
An independent, North Carolina based security consultancy. Led by Roland Blandon, Principal Consultant. You work directly with the person doing the testing.
No testing begins until the system owner has signed written authorization.
Testing stays inside the written scope and the agreed windows.
Engagement evidence is retained for 90 days after the final report is delivered, then securely destroyed.
Verification of your fixes is part of the engagement.
Tell us what needs testing, your timeframe and any compliance requirement behind the project. If you are unsure how to scope it, start with a conversation.