VUNVAULT is a Nairobi-headquartered offensive security firm. We run adversary emulation, penetration testing and continuous attack-surface mapping for SACCOs, fintechs, M-Pesa gateway providers and enterprises — teams whose uptime is measured in livelihoods, not service credits.
Most assessments are written for auditors. Ours are written for the engineer who has to ship the fix before Monday. That single bias shapes everything below.
To make advanced offensive security reachable for the institutions that carry African economies — SACCOs, fintechs, payment gateways and public infrastructure — by pairing adversary-grade tooling with plain-language reporting that a board can actually act on.
We do not sell fear. We map exposure, prove impact, and hand back a prioritised path out of the blast radius.
A continent where a two-person IT team in Kisumu has the same defensive leverage as a Tier-1 bank in Zurich. That means automation, telemetry and continuous validation — not annual PDFs.
We are building the sensor network, the academy and the tooling to close that gap permanently.
Every VUNVAULT engagement is delivered against the same three pillars — the technical, the regulatory and the human. Drop one and the other two collapse.
Adversary emulation that mirrors the tradecraft actually landing on East African targets — not a generic scanner dump.
Findings mapped to the framework your regulator actually cites — so remediation doubles as evidence.
A finding you can't reproduce is a finding you can't fix. We train your team to hold the line after we leave.
Four disciplines, one floor. Every engagement is staffed by the people below — not subcontracted, not anonymised behind a logo.
Lead Offensive Security Engineer
Leads VUNVAULT's red-team engagements across SACCOs, fintechs and M-Pesa gateway providers. Amara specialises in web application penetration testing, custom parameter fuzzing pipelines and zero-day research — the kind of work that finds the bug a scanner's signature list will never reach. She has disclosed seven responsibly-handled vulnerabilities in payment and identity platforms operating in East Africa, and runs the internal exploit-development review that every VUNVAULT finding passes through before it reaches a client report.
Security Automation & Recon Architect
Builds the reconnaissance and validation engine underneath every VUNVAULT engagement. Daniel owns the multi-threaded SSL/TLS validation tooling, the endpoint-crawling pipeline that turns a single domain into a scored asset map, and the Python and Bash automation that keeps the whole stack reproducible. His rule is blunt: if a check cannot run unattended at 03:00 against a 4,000-host estate and return the same result twice, it does not ship. He also maintains the internal patch-validation CLI used to confirm remediation before we close an engagement.
Threat Intelligence Analyst
Owns the zero-day tracking feed and the attack-surface mapping methodology that opens every engagement. Fatima spends her week correlating NVD entries, vendor advisories and VUNVAULT sensor telemetry into a single exploitation-status view, and profiling how WAFs actually behave against the payloads we throw at them. Her briefings on ransomware playbooks targeting East African SACCOs are now read by security teams in four countries. She writes the weekly threat note that goes to every retainer client.
Compliance & Governance Lead
Translates raw technical findings into the language regulators and boards actually use. Brian owns the Central Bank cybersecurity standards mapping, GDPR and Kenya Data Protection Act framework alignment, and the rules-of-engagement and non-disclosure agreements that govern every engagement VUNVAULT accepts. He also authors the Academy compliance curriculum and sits in on every scope call, because the fastest way to break a client is to test something nobody authorised you to touch.
A live slice of the VUNVAULT sensor network — the same telemetry that feeds client dashboards and our weekly threat note.
Refreshed continuously from NVD, vendor advisories and the VUNVAULT sensor network. Times shown in UTC. Telemetry is aggregated and contains no client-identifying data.
Start with a free external vulnerability scan, or talk to an engineer about a full adversary-emulation engagement mapped to your regulator's framework.