# Bendings

> Bendings is a cybersecurity firm founded in 2013. It runs reconnaissance, red team, penetration testing, physical and social-engineering testing, blue team support and incident response for governments, banks and asset managers in the United States and the Gulf Cooperation Council states. Its own AI model, Bendings Gauge, runs continuous red and blue team work inside limits each client approves, on Bendings Frame, the firm's own operating system for digital and physical security operations.

Bendings has worked by referral since 2013. It does not publish client names. Every engagement runs under a signed scope, written authorization from the system owner and agreed rules of engagement, with a named person on the client side who can stop the work. The team that scopes an engagement also runs it and returns for the retest.

- Founded: 2013
- Clients: government agencies, banks, asset managers
- Regions: the United States and the Gulf Cooperation Council states (Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, United Arab Emirates)
- Engagements: engage@bendings.com
- Vulnerability reports: security@bendings.com

## Capabilities

- [Reconnaissance](https://bendings.com/capabilities/reconnaissance): Learn what an adversary can find out about you before they try anything. We map the digital exposure you agree to and show where closer testing is worth the time. Scope: Authorized external reconnaissance and attack-surface review. Deliverable: An exposure map, supporting evidence and priorities for further testing.
- [Red team](https://bendings.com/capabilities/red-team): Find out whether an adversary could reach an objective that matters to the business. One agreed scenario tests technology, people and your response together. Scope: Objective-led adversary simulation within agreed rules of engagement. Deliverable: An evidence-led account of attack paths, control gaps and defensive observations.
- [Penetration testing](https://bendings.com/capabilities/penetration-testing): Find the weaknesses in your applications and infrastructure, and learn what each one would let an attacker do. Scope: Web, API, mobile, cloud, internal and external infrastructure, operational technology and hardware. Remote, on site or in our lab, as agreed. Deliverable: Validated findings, evidence of impact and remediation guidance in priority order.
- [Physical and human testing](https://bendings.com/capabilities/physical-and-human): Test the doors and people around your systems. Safety limits and stop conditions are agreed before anyone arrives on site. Scope: On-site physical security and social-engineering assessments under explicit written authorization. Deliverable: Documented control failures and practical recommendations for facilities, procedures and staff awareness.
- [Blue team and incident response](https://bendings.com/capabilities/blue-team): Put experienced defenders beside your team for a fixed period, focused on the threats and detection gaps you name, and reach them at any hour when an incident starts. Scope: Time-bound secondment, threat hunting, detection validation and a 24-hour incident response retainer. Deliverable: Documented investigations, detection improvements and response recommendations matched to the agreed remit.

## Bendings Gauge

Bendings Gauge is our own AI model for continuous red and blue team work. It tests and watches your organization around the clock, inside limits you approve, with our operators in the loop.

- Scope it cannot leave: Gauge itself refuses any target outside the signed scope, whatever it finds along the way.
- Operators approve risky steps: Exploitation, lateral movement and other risky actions wait for a Bendings operator to approve them.
- You can stop it at any time: A named person on your side can halt Gauge immediately.
- It runs where your data lives: Inside your network, in your country or fully air-gapped. Your data stays there and is never used to train the model.
- Every action on record: Gauge logs each action it takes, and the complete log is handed to you.

Details: https://bendings.com/gauge. Technical documentation of the model is shared under a nondisclosure agreement.

## Bendings Frame

Bendings Frame is the operating system our team works in. It brings your digital and physical security into one live picture, runs our operations and carries Gauge and our tooling, with people approving what matters.

- One live picture: Logs, alerts, network and device data from many sources, brought together as they arrive.
- Physical systems too: Cameras, access control and sensors sit in the same picture as your networks.
- Operations, planned and run: Our operators plan, assign and run offensive and defensive operations across teams and sites.
- Gauge and our tooling: Gauge and our in-house tools run on Frame, which schedules, controls and records their work.
- Response within set rules: Frame detects, decides and responds on its own within rules set in advance. People approve what matters.

Controls:

- People approve what matters: Frame acts on its own only within rules set in advance. Decisions that matter go to a person.
- Only our operators work in it: Bendings operators run Frame. You see what it finds, not the system itself.
- Work on record: Frame records the work of Gauge and our tooling as it schedules and controls it.
- It runs where you need it: Inside your network, in your country, fully air-gapped or hosted by us.

Details: https://bendings.com/frame. Technical documentation is shared under a nondisclosure agreement.

## In-house assets

- Members of the team hold government security clearances; which ones are confirmed in writing at scoping.
- Offensive and defensive tooling built and maintained by Bendings.
- A lab for operational technology, embedded devices and radio interfaces.
- An incident response retainer: the team can be reached 24 hours a day, with the response time written into the contract.

## The firm

- [The firm](https://bendings.com/firm): who Bendings hires, how engagements are staffed, standing policies and work the firm declines.
- [Method](https://bendings.com/method): how every engagement runs, from signed authorization to a retest letter, with safety limits and data handling.
- [Regulated work](https://bendings.com/regulated-work): testing scoped and reported against US, Bahraini, Saudi and Qatari frameworks and threat-led testing schemes.
- [Engage](https://bendings.com/engage): what to include in a first email and what happens after.

## Research

- [The Seam Report 2026](https://bendings.com/research): Where intrusions bend between the systems you test. Cyber, physical and human attack paths in the United States and the Gulf, measured from public evidence only. PDF: https://bendings.com/research/seam-report-2026.pdf. Data and code: https://bendings.com/research/seam-report-2026-data.zip.

- Tests cover the steps. They miss the joins. In 70 of 78 public intrusion paths from 2013 to 2026, every step on the victim’s own systems fell in a domain some single-domain test covers. A typical red team scope could follow 33 end to end. Of the 45 it could not, 38 ran through another organization the victim cannot authorize a tester to touch.
- Products sold to keep intruders out are a growing way in. Among recently published flaws, security controls rose from 10.7 percent of CISA’s exploited-list additions in January to September 2022 to 17.6 percent in the same months of 2026. Their median time from publication to listing is two days.
- Most new SEC incident filings no longer call the incident material. After the SEC staff statement of May 2024, 33 of 112 new incidents were first filed under Item 1.05, against 17 of 23 before.
- Whoever resets a password is part of identity. US advisories from 2023 to 2026 keep naming help-desk staff who reset credentials when a caller asks.
- Harm reaches further than the adversary goes. In 7 of 78 documented intrusions, operational technology stopped because IT was lost, against 6 in which the adversary acted in it. In 48, harm reached other organizations.
- In the Gulf, recovery advice and residency rules pull apart. After the March 2026 drone strikes, the cloud provider advised recovery in Europe and later said some data held only in the region could not be restored, while Gulf rules keep core records in-country.
- AI agents under test reached real organizations. In July and August 2026, three evaluators reported AI systems under cyber testing reaching organizations no one had pointed them at.
- The fix, not the finding, takes the time. The PHP project fixed two critical flaws on October 21, 2026, after first seeing signs of one in 2024. The next day 32 UK government services were unavailable and four partly so, largely as a precaution, with no confirmed compromise of central government systems.
- Testing rules stop at the building, the person and the supplier. Of 41 US and Gulf testing regimes, 1 requires a physical intrusion test, 5 a test of people and 9 a test of supplier-run systems. None of 50 sets rules for AI-driven testing.

## Optional

- [Legal and privacy](https://bendings.com/legal): website privacy, authorized testing and responsible disclosure.
- [security.txt](https://bendings.com/.well-known/security.txt)