// ABOUT KAIJU SECURITY

Veteran-owned. Hacker-led.

Kaiju Security is a veteran-owned offensive security firm. We deliver top-tier penetration testing, red team, physical security and social engineering services at fair prices, performed by senior experts who actually do the work.

// Why we exist

We built the firm we believed needed to exist.

We started Kaiju to deliver top-tier penetration testing at affordable prices, and to eliminate the snake oil in cybersecurity: vulnerability scans sold as pentests, inexperienced and burnt out testers on complex engagements, reports that didn't address the real security issues.

Kaiju is a small, agile boutique. Every engagement is led and executed by experienced operators, and you get straight answers about what is broken, how we proved it and how to fix it.

// Leadership

Founders who still do the work.

Our leadership team are working hackers and security professionals, not account managers. They scope, lead and perform engagements themselves.

Gary DeMercurio

CEO, Co-Founder.

LinkedIn

Justin Wynn

President, Co-Founder.

LinkedIn

AJ "RA" Scotti

Co-Founder. Strategic Development and Physical Security.

Marcus Peterson

CTO, Co-Founder.

Jesse Ratcliffe

CSO, Co-Founder.

// Our story

The Iowa courthouse job changed everything.

In 2019 the Iowa Judicial Branch hired members of our team to red team the physical and digital security of five government buildings, including courthouses, with after-hours covert entry testing authorized in the contract. At the Dallas County Courthouse, officers who responded to an alarm confirmed we were authorized. The sheriff then arrived and had Gary and Justin arrested and charged with felonies. The charges were later reduced and dropped, and in January 2026 Dallas County settled the lawsuit the two brought to set the record straight.

That experience shaped how we work: clear authorization, documented scope, real partnership with the people we test and respect for the law enforcement and stakeholders around every engagement. It is also why we built Kaiju Security, to do this work the right way.

// The team

Senior experts. No outsourcing. No handoffs.

Our team of experts is made up of senior testers, most with ten or more years of experience. We have delivered work for high-profile government and military organizations. The people you meet during scoping are the people who perform the engagement.

Veteran-owned
Mission-first discipline, clear rules of engagement and accountability on every job.
Senior-only delivery
Most of our testers have 10+ years of experience. No junior bench and no subcontracting.
Clients treated right
Honest scoping, fair pricing, direct access to the testers and reports you can act on.
// Capabilities

Offense across every attack surface.

From a single application to a full-spectrum campaign, we test how real adversaries would reach you through technology, people and places.

Penetration testing

External and internal network, wireless, application and API, mobile, cloud, hardware and IoT, AI and LLM, EDR efficacy and compliance-driven testing (PCI DSS, FedRAMP pre-assessment, NIST, ISO-aligned). Rapid pentesting

Red team and adversary simulation

No-notice, full-spectrum, tailored and logical red team operations, assumed-breach and insider-threat exercises, and purple teaming. Learn more

Physical security

Covert entry, whitelist walkthroughs and controls reviews of your facilities by operators with a decade of field experience. Learn more

Social engineering

Phishing, vishing, deepfake and on-site pretexting that show how your people respond to real manipulation. Learn more

Ransomware readiness

Kaijin ransomware simulation and tabletop exercises that test executive, technical, legal and communications response. Learn more

Advisory, intelligence and training

Attack surface and breach intelligence, digital forensics and incident response, SOC development, executive briefings and hands-on training.

// Our tools

We build our own tools and exploits.

We do not just run the same commercial scanners as everyone else. Our team develops custom tooling and original techniques, and we publish and share our research with the community.

Stockpiler
Build your own cache of cyberweapons. Read more
PolyDrop and BYOSI
Research into EDR bypass and script interpreter abuse. PolyDrop | BYOSI
Kaijin
Our ransomware simulation platform for safely testing readiness. Learn more
// Work with us

Ready for a test that tells you the truth?

Tell us what you want to learn and we will help you scope the right engagement.