September 9, 2026
AI and LLM Penetration Testing in 2026: The New Attack Surface
Obventum, offensive security from Poreč, Croatia
We find the way in before a real attacker does.
An ethical hacking company working across Croatia, the Netherlands and the EU. Under written authorisation we attack your systems as a real intruder would. We prove what we reached and hand you a ranked plan to fix it.
Free intro call. No obligation. Pricing on request.
Diagram: an attack path from the internet to the domain controller is found, proven, closed and retested.
Illustration: a typical attack path we find, prove, close and retest.
What we do
Four services. One question: how would you be breached?
Scoped to your environment, never a generic checklist. Each one ends with proof, not opinions.
Penetration Testing
Infrastructure, Active Directory, cloud, web apps, APIs, wireless and IoT. We usually test in two phases. First from outside, with no inside knowledge, to map what is exposed. Then from inside, as if an attacker already had a foothold. You get every proven weak point ranked by CVSS, with a fix for each.
Read moreSocial Engineering
Phishing by email, SMS and phone, plus on-site tests where we walk in and try doors, badges and unattended screens, within agreed rules. You see how far an intruder could get through your people, then we train your staff on what worked.
Read moreReverse Engineering
We take apart your SaaS, app, binary or firmware. You get a list of the ways it can be broken or abused, each one proven.
Read moreRed Teaming
A goal-based attack on technology, people and processes, minimum two months. You get evidence of whether your detection and response hold against a real intrusion.
Read moreAlso available
Secure Code Review
We read your code to find flaws that testing from the outside cannot see. Available as an add-on to any penetration test.
OSINT Exposure Check
Open source intelligence: what an attacker can learn about your company, its people and its systems from public sources. Ask us for a scoped quote.
How we work
Written rules, known standards, six phases
Six phases on every engagement, following public standards, under safety rules we put in writing.
- 01
Kick-off
Scope, rules of engagement, testing windows and written authorisation.
- 02
Discovery and scanning
Systems, services and versions mapped: your real attack surface.
- 03
Testing and exploitation
We prove what an attacker could reach and how far they could spread, without causing damage.
- 04
Reporting
Findings ranked by risk, each with evidence and a remediation step.
- 05
Debrief workshop
A walkthrough of the findings with your team.
- 06
Retest
We confirm the key findings are actually closed.
PTESOWASP Testing Guide and Top 10MITRE ATT&CKCVSS v3.1 / v4Supports NIS2 and ISO 27001
In writing
What we promise, and what you receive
Safety rules
- No denial of service, no destructive actions, no changes to production data
- Agreed scope and testing windows
- A direct channel to the tester
- Critical findings reported the moment they are confirmed
Deliverables
- Executive summary for management
- Technical findings ranked by risk with CVSS
- Evidence and proof of concept for every finding
- Prioritised remediation plan
- Debrief workshop
- Retest of key findings
Who we are
Two founders who scope the work, do the testing and write the report
Luka Bayer and Fady Oueslati have been taking systems apart since they were kids, from hacking to infrastructure, and both turned it into a profession. Through Obventum and its sister company ReactiveZero, their clients range from small municipalities and companies with a few hundred employees to national government agencies and multinational enterprises, across Croatia and the Netherlands.
No sales layer, no handover: the founder on your intro call is the one inside your network.
Luka Bayer
Founder and Ethical Hacker
Leads client projects, from external network tests to full-scale intrusions. Writes reports engineers and executives can both act on.
inLinkedIn
Fady Oueslati
Co-founder and Ethical Hacker
OSCP (hands-on exploitation) and CHFI (digital forensics) certified. Web application, API and infrastructure testing. Finds the business logic flaws automated tools miss and hands developers the fix.
inLinkedInHow we test
How we test a web application
Web & Application Security
Why web applications and APIs are the most common way in, and how we test them.
See how we test itFrom the blog
Guides on AI testing, NIS2 and ransomware
Practical reading for EU companies on the threats we test against.
Sister company
Obventum, ReactiveZero and an AI pentesting platform in beta
ReactiveZero is our sister company in the Netherlands, run by the same two founders. Same people, same method.
Together we run four NVIDIA DGX systems in our own environment, training a local offensive security model for an AI-assisted penetration testing platform, now in beta. A human tester validates every result, and data never leaves hardware we control.
© 2026 Obventum d.o.o. All rights reserved
Developed by Reakt Studios
