# Software & Infrastructure Teams

> Web, mobile, cloud, backend, AI, and other critical software systems.

Canonical page: https://www.guvenkaya.co/solutions/software-infrastructure

**Find attack paths across your applications, cloud, and identity.** We test how weaknesses in applications, APIs, cloud, and identity can expose data or grant privileged access.

## When to test your systems

- **Before a release that changes the attack surface**: A new integration, tenant model, or public endpoint changes what is reachable.
- **When cloud and identity have grown organically**: Roles, service accounts, and trust relationships accumulated faster than anyone mapped them.
- **Before a customer or regulator asks**: Get evidence of security testing before a customer or regulatory assessment.
- **When AI features touch real data or actions**: Tools, retrieval, and agent permissions create paths that existing testing does not cover.

## Where attack paths begin

We investigate weaknesses in each layer and test how they can combine into an attack path.

- **External surface**: Internet-facing applications, APIs, forgotten hosts, and everything a scanner sees first.
- **Identity & privilege**: Accounts, roles, and federation, and the one escalation that turns ordinary access into control of the environment.
- **Cloud control plane**: Secrets, CI/CD, workload identity, storage policy, and who can change the environment.
- **Data & agent actions**: Where data concentrates, and what automated or AI-driven actions can reach without review.

## Engagement team

Offensive security, financial-services assessment, and product security leadership. Two of the three run security at other companies today.

- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.
- **Łukasz Mikuła**, Specialist Advisor: Offensive security, exploit development, mobile, infrastructure, and multi-ecosystem reviews.
- **Paul Vijender**, Specialist Advisor: Product security, IAM, cloud, network, data, DevSecOps, blockchain, and AI leadership.

## Relevant services

- [Penetration Testing](https://www.guvenkaya.co/services/penetration-testing.md): Start here. This is the engagement that chains findings into the path an attacker would take.
- [Secure Code Reviews](https://www.guvenkaya.co/services/secure-code-review.md): Use this when the risk is in logic a black-box test will not reach.
- [AI & Agent Security](https://www.guvenkaya.co/services/ai-agent-security.md): Use this when models, tools, retrieval, or agent permissions touch real data or real actions.
- [Secure Architecture & Process Design](https://www.guvenkaya.co/services/secure-architecture-process-design.md): Use this when the answer is a design change rather than a fix list.

## Discuss your system’s security.

Describe the application, its environment, and your deadline. We will help define the scope.

Discuss your scope: https://www.guvenkaya.co/contact