Referral work since 2013.
Bendings is a cybersecurity firm that has tested governments, banks and asset managers in the United States and the GCC since 2013. Most clients find us through other clients.
The bar for joining is set by the hardest places to work.
We look for people who have already worked where a mistake has national, financial or scientific consequences. Candidates reach us through people who work with us, and each one is tested on a live problem by the team they would join.
We would rather leave a seat empty than fill it below that bar.
- National cyber operations
- Offensive or defensive operations carried out for a government, under the legal authorities and oversight that come with them.
- Research-scale computing
- The networks and data systems of large scientific laboratories, where infrastructure runs at a scale few companies ever see.
- Market infrastructure
- Trading, clearing and settlement systems, where a millisecond and a missing control both have a price.
- Applied cryptography
- Review of protocols and their implementations, held to the standard of published research.
- Defense software
- Command-and-control systems that fuse sensor data and direct operations for armed forces.
What we built ourselves.
Ask about any of them when you write. What cannot be published we share under a nondisclosure agreement.
- Bendings Gauge
- Our own AI model for continuous red and blue team work, run inside limits you approve.
- Bendings Frame
- The operating system our team works in: one live picture of digital and physical security, our operations, and the platform Gauge and our tools run on.
- Our own tooling
- We build and maintain our own offensive and defensive tooling.
- A hardware lab
- Operational technology, embedded devices and radio interfaces can be tested in our lab as well as on site.
- Incident response at any hour
- Retainer clients can reach the team 24 hours a day. The response time is written into the contract.
Standing policies.
These apply to every engagement, whoever you speak to at the firm.
- Client names
- Stay private. We do not publish them or use them in proposals.
- Authority
- No testing starts without a signed scope, written authority from the system owner and a named person on your side who can stop the work at any time.
- Findings
- Each one ships with the evidence behind it and a fix path your engineers can follow. A finding we cannot demonstrate does not go in the report.
- Both sides
- The people who tested your defenses can stay afterward to help your team strengthen them, under a separate agreement.
How we staff an engagement.
A named lead
One person owns the engagement from the first call. You know who they are before anything is signed, and they answer for the work.
One team throughout
The people who scope the work also run it and return for the retest. Nothing is handed to a second team you have not met.
Cleared staff
Members of the team hold government security clearances. Tell us at scoping what your rules require and we will confirm in writing who meets them.
Work we decline.
We turn down some requests at the first message. If your inquiry falls here, we will tell you plainly and not quote.
- Testing any system without the authority of the person or organization that owns it.
- Work intended to harm or surveil a third party.
- Publishing or selling what we find in a client environment.
- Engagements where no one on the client side can be named to stop the test.
Discuss an engagement privately.
Write from your organization's email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.