Offensive Emulation
COFFSec is a Hong Kong cybersecurity consultancy and research collective dedicated to creating a safer digital world. We aim for real-world impact that scales. Our cutting-edge security consulting and innovative research for global technology partners directly influence people, processes, and technologies helping to safeguard the digital lives of billions.
Mission
Safeguard the security of critical computer systems and infrastructures.
Vision
Build a safer digital world and enhance overall computer system security in Hong Kong.
Values
Ensure Confidentiality, Integrity, and Availability (CIA) of your data.
Core Services
Comprehensive security assessments tailored to your organization's needs
01Red Team & Purple Team
Advanced adversary simulation
02Web & Mobile Penetration Testing
Comprehensive application security assessments
03Source Code Review
Automated static analysis for vulnerability detection
04Network Penetration Testing
External infrastructure security assessment
05Incident Response
Rapid containment and recovery from security incidents
06GenAI Security
Red-teaming & guardrailing for LLM and AI applications
Security professionals with proven track records
Our team brings together experienced offensive security practitioners with a proven track record across industry certifications, competitive achievements, and real-world vulnerability research.
Certified Expertise
Holders of top-tier industry certifications.
Proven in Competition
Recognized in national and international CTF events.
Real Research
Contributors to vulnerability research and responsible disclosure.
Ready to Secure Your Organization?
Speak with a senior offensive security consultant about your environment. We map how an attacker would reach your critical assets, then help you close those paths.
Response within 24 hours
A senior consultant reviews your request and replies directly.
Scoping call
We define targets, rules of engagement, and the testing window.
Testing begins under NDA
Confidentiality is in place before a single packet is sent.
No obligation, no sales pressure. A technical conversation with the team who will run the engagement.