Result-proven cybersecurity.

Theme

Book a consultation

Result-Proven Cybersecurity

Think like an attacker.
Defend like one too.

Someone will find the way in. Make sure it’s us — before it’s them.

We don’t sell reassurance — we prove it. Adversary-grade testing that finds what scanners miss, with clear evidence and a fix you can act on.

24-hour reply · NDA before we touch anything · re-test available on every engagement

Accredited & recognized

A state-recognized cybersecurity auditor — not a self-declared badge

OffSeq (SEQ SIA, reg. 40203410806) is on Latvia’s official register of cybersecurity auditors and part of the national and European competence networks.

Services

What to order

Pick the group that matches your situation — from offensive testing to monitoring, governance and EU compliance.

Coverage

What we test

One adversary mindset, applied across every surface an attacker can reach. Each row links to the service that owns it — depth scales from a focused assessment to a full-scope red team.

See the full coverage matrix
  • Web apps & APIs
  • External attack surface
  • Cloud & containers
  • Internal network & AD
  • Source code & supply chain
  • AI / LLM systems
  • Mobile applications
  • People (social engineering)
  • Wireless & physical
  • OT / IoT & embedded

How we work

A sequence, not a scan

Repeatable, transparent phases that turn an attacker’s view of your organization into measurable resilience.

  1. 01

    Reconnaissance

    Map your real attack surface — assets, exposure, people and third parties — the way an adversary would.

  2. 02

    Assessment

    Probe and test: vulnerability assessment, penetration testing, social engineering and red team simulation.

  3. 03

    Reporting

    Severity-rated findings with business impact, proof, and a prioritised remediation roadmap.

  4. 04

    Resilience

    Continuous monitoring, incident-response readiness and compliance — so gains hold over time.

In the field

Offensive security, in practice

Real engagements, real venues, real kit — from classified cyber ranges to hacker camps and the security community.

CR14 Classified Cyber Range
CR14 — classified cyber range
Field hardware testing kit
Field kit — hands-on hardware testing
Security community hacker camp
Hacker camps & the security community

Result-Proven

We don’t claim security. We prove it.

The same researchers who find flaws in national infrastructure and enterprise software run your engagement — and ship the security platform you can actually use. Proof and product, not promises.

Critical

Command injection fixed in Estonia’s national eID software

DigiDoc4 — Estonia’s official eID signing client

DigiDoc4’s file-manager integration built shell commands by pasting filenames straight into a command line. A file named with shell metacharacters would run arbitrary code the instant a citizen right-clicked it to sign or encrypt — no prompt, no warning. On a client used daily for legally-binding signatures across an entire country, that is as serious as it gets.

OS command injection (CWE-78) Read the write-up
How we’d test yours
High CVE-2024-28996 · CVSS 7.5

SWQL injection in SolarWinds Platform

SolarWinds Platform (≤ 2024.1 SR 1)

A query-language injection flaw let an attacker manipulate backend database queries in one of the most widely deployed IT-monitoring platforms in the world. Discovered while pen-testing for the NATO Communications and Information Agency.

SQL / SWQL injection (CWE-89) View on NVD
How we’d test yours

Proof

Trusted across the Baltics and beyond

In their words

What people say about working with us

At Trace.Space, security has always been a core priority — not an afterthought. As an AI platform trusted by engineering teams building regulated products in automotive, aerospace, medical and defense industries, we hold ourselves to the highest standards. Because we are shipping features at an incredible pace, we recognized that we needed a security partner capable of scaling at our velocity. That is exactly why we partner with OffSeq. We don’t want a standard checkbox compliance vendor; we want an elite partner to help us continuously take our security posture to the next level. Instead of slowing us down, they seamlessly integrate with our fast-moving engineering team, providing proactive, high-level insights that let us fortify our systems in real time as we grow. Working with OffSeq consistently proves that when you are building fast, having a world-class security partner in your corner is the best way to stay ahead of the curve.
Karlis Broders CTO · Trace.Space
We’ve had the pleasure of working with SEQ SIA (led by Nils Putniņš) on multiple information security engagements at Printful, ranging from targeted penetration testing to in-depth evaluations of our platform’s security maturity. In every project, SEQ SIA has demonstrated a rare combination of technical precision, strategic thinking, and professionalism. Most recently, during a performance and security audit of one of our core systems — used daily by thousands of employees and clients — SEQ SIA delivered beyond expectations. Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience. SEQ SIA has become a trusted security partner, and we highly value the clarity and confidence they bring to complex security challenges.
Oskars Podziņš Head of Information Security · Printful
I had some expectations when we signed up with OffSeq. I was expecting some social engineering, routine web works to see our loopholes. Instead, they dug with passion, and they dug deep. They found holes me and my IT team were astonished to hear about. They worked from the heart and in high quality.
Andzejs Stenclavs Kinetics
We confirm that SIA “SEQ” conducted three information system security audits in 2025. The audits were carried out professionally and in full compliance with the contractual requirements. We are satisfied with the service provided. — State Emergency Medical Service of the Republic of Latvia (NMPD).
Liene Cipule Director · NMPD
Ar šo apliecinām, ka SIA “Codex” ir veiksmīgi sadarbojies ar SIA “SEQ” un tā speciālistu Nilu Putniņu vairāku nozīmīgu projektu ietvaros. Sadarbības laikā esam augsti novērtējuši SIA “SEQ” sniegto pakalpojumu kvalitāti, profesionalitāti un atbildīgo pieeju. Visas saistības veiktas norunātajos termiņos un augstā kvalitātē. Nils Putniņš ir apliecinājis sevi kā augstas klases ekspertu informācijas sistēmu drošības un kiberdrošības jomā.
Vladimirs Dagenvalds Board Member · Codex
The OffSeq team collaborated with the LG team to identify and resolve several high-severity vulnerabilities within LG’s products and services promptly. We appreciate their dedication to helping us improve the security of LG Electronics.
LG PSRT Product Security Response Team · LG Electronics
In Eleving Group security resilience is at the core of what we do across 17 markets and more than 1.8M customers. Partnering with OffSeq on a red team engagement gave us a genuine adversarial perspective that went well beyond a traditional penetration test. Their team demonstrated deep technical expertise, operated with realism and precision, and communicated findings in a way that was both clear and actionable. We came away more resilient and better informed.
Oskars Zīle CISO · Eleving Group
Working with OffSeq has been a solid experience from day one. They’ve helped us with red teaming, penetration testing, and assessments — not just for our own systems but also for some of our clients. What stands out is their practical approach — no fluff, just clear findings and actionable recommendations. They know how to dig deep, but they also understand how to communicate technical risks in a way that makes sense to different stakeholders. We’ve come to trust them as a reliable extension of our security team, and we’re looking forward to continuing the collaboration.
Viktors Trifanovs CISO · TestDevLab
We export to over 20 countries, so the security of our systems and client data isn’t something we take lightly. OffSeq ran a black-box audit that showed us exactly where we stood — no sugarcoating, just an honest picture from a real attacker’s perspective. The report worked for both our IT team and our board, which is rare. Really solid work all around.
Ivo Petrovskis Network & Security Administrator · Livonia Print
We were working with SEQ and their expert Nils Putniņš for security testing of our systems and we are happy with the results and their fast response time. We recommend SEQ and are looking forward to a long-term collaboration.
Mareks Zirdziņš Director of IT Operations · Standards Digital
SEQ and specialist Nils Putniņš performed a security audit for a project in development at Jāņa Sēta in June 2023. We are very satisfied with the test results, which helped improve the system’s security. The work was done quickly and to a high standard. We plan to keep working with SEQ.
Mareks Kilups Board Member · Jāņa Sēta

FAQ

Frequently asked questions

Are you an officially recognized cybersecurity auditor?

Yes. OffSeq (SEQ SIA, reg. 40203410806) is on Latvia’s official cybersecurity auditors list, maintained by the Digital Security Supervision Committee — authorised to perform mandatory NIS2 / National Cyber Security Law compliance audits. You can verify us directly on cyber.gov.lv.

Will I get proof, or just a scanner dump?

Every finding is manually reproduced and rated by real business impact, with the request, response, payload and a concrete fix. You can see a complete sample report — covering Critical to Low findings — on our sample-report page.

How fast do you report critical findings?

Immediately on confirmation. You never wait for the final report to learn you’re exposed — anything critical is flagged the moment we verify it, so you can start remediating during the engagement.

Do you verify that our fixes actually worked?

Yes. A re-test is available on every engagement: we re-check each remediated finding and update its status, so you get closure, not just a list of problems.

What regions and sizes of organization do you work with?

We work with organizations across the Baltics, Scandinavia and the wider EU, from scale-ups to national agencies and enterprises. Engagements are scoped to your risk and timeline — not a fixed package.

Do we need a designated cybersecurity manager under NIS2?

If you’re an essential or important entity under NIS2 (or a national cybersecurity law), you must designate someone accountable for cybersecurity. Rather than hiring full-time, our CISO-as-a-Service provides that qualified leadership and handles mandatory authority reporting.

How do you help with NIS2, DORA and ISO 27001 compliance?

We scope which obligations apply, run a gap analysis against the controls, and hand you a prioritised remediation roadmap and the evidence package — grounded in how you’d actually be attacked, not a generic checklist. For DORA we also run TIBER-EU-aligned threat-led penetration testing.

Scope an engagement

Tell us what you’re protecting. We’ll show you how we’d attack it — and how to hold the line. 24-hour reply.