Exception Security
Private, invitation-only offensive security
Exception Security runs private, invitation-only security testing for
organisations that need the work done without announcing it. Every
researcher is identity-verified before they are invited. Testing cannot
begin until a named scope, an NDA and a written testing authorisation
all exist, and access outside the authorised window is refused by the
platform rather than discouraged by policy.
Our team validates and severity-scores every finding. Researchers
reach you under a stable pseudonym and are never
given your organisation's name, officers or contacts. Nothing about
your systems is published unless you approve the exact wording — a
consent step in the software, not a line in a policy.
Unlike a penetration test, you are not buying days. There is no
subscription, no setup fee and no retainer: you are billed only for a
finding you have accepted, at a reward you set before testing
begins. If nothing is
found, there is nothing to pay.
Enquiries are answered individually. There is no self-serve tier and no
public directory of clients. Write to
support@exceptionsecurity.com.
How the platform works ·
How to receive a vulnerability report ·
What a private bug bounty is ·
Bug bounty vs penetration testing