About

Who runs this, and how it works commercially

A buyer handing over their attack surface is entitled to know who is accountable for it, where the work is run from, and exactly what they are committing to pay. All three are on this page, without the vagueness that usually sits here.

What we do

Exception Security runs private, invitation-only offensive security engagements. A client names a scope and a window. Identity-verified researchers are invited onto it under a written authorisation and a non-disclosure agreement. Our team validates and scores every finding, and nothing about the engagement is published unless the client has approved the exact wording.

It is deliberately not a public programme. A public programme announces to every competitor and opportunist that you are looking, and invites strangers nobody has checked to probe a brand you spent years building. If you are weighing the options, the explanation of a private programme and the comparison with penetration testing set out where each approach genuinely wins.

Who is accountable

Exception Security is a trading name of Vivek Kumar, who founded it and is the point of contact for every engagement. A platform that keeps researchers anonymous still has to say who stands behind it, so: the founder's LinkedIn profile is in the name Vivek Jha, and documents and instruments carry the legal name Vivek Kumar. They are the same person, and saying so once here saves a careful buyer the trouble of wondering.

Where we are

Engagements are delivered remotely, which is how offensive security work is done almost everywhere: the researchers are distributed, the systems under test are reachable over the network, and evidence moves through the platform rather than a meeting room. The location that actually affects a client is the second one — where their data sits — and that answer is Mumbai, with the subprocessors named rather than summarised.

How clients are billed

There is no subscription, no setup fee and no retainer. Clients are billed only for a finding they have accepted, at a reward they set themselves. A finding you reject costs nothing. An engagement that turns up nothing worth accepting costs nothing.

That is unusual enough to be worth stating plainly, because it answers the question behind most procurement hesitation: what happens if this does not work. The answer is that you do not pay for it.

Talking to us

If you want a starting point that commits you to nothing, ask us what your own domain currently publishes to a stranger looking for a way to report a flaw. We will tell you what we see, whether or not it goes anywhere — the method is on the vulnerability disclosure page if you would rather check it yourself.