Meet the ethical hackers behind Obventum
Offensive security from Poreč, for clients in Croatia, the Netherlands and the wider EU.
Obventum is run by Luka Bayer, from Croatia, and Fady Oueslati, from Tunisia, based in Rotterdam, the Netherlands, where our sister company ReactiveZero is headquartered. They are the two people who will test your systems.
They met in the Netherlands while studying cyber security at Fontys University of Applied Sciences in Eindhoven. During the final two years of that degree they already worked full time as cyber security consultants and ethical hackers. Both have been at this since they were kids, from hacking to infrastructure, and both turned it into a profession.
Luka Bayer
Founder and Ethical Hacker
Luka leads client projects, from local government bodies to private enterprises. His work covers everything from external network tests to full scale intrusions. On many engagements he has taken control of the systems an organisation depends on most, always under strict authorisation.
He writes every report for two readers: the engineer who has to fix the finding and the executive who has to act on it. Outside work he trains as a boxer and works on cars.
Fady Oueslati
Co-founder and Ethical Hacker
Fady focuses on web applications, APIs and infrastructure, and he is known for the business logic flaws that automated scanners miss. Those are the cases where an application works exactly as built and can still be abused, for example to read another customer's data. When he reports a finding, he explains the root cause and hands the developers a fix.
He holds the OSCP, a hands-on exploitation exam, and the CHFI, a digital forensics certification. He can break into a system like an attacker and reconstruct the intrusion like an investigator. Off duty he plays football and works on cars.
Our promises
Five things you can hold us to
We test to recognised industry standards: PTES, the OWASP Testing Guide, OWASP Top 10 and MITRE ATT&CK. Our reports give you the evidence you need for NIS2 and ISO 27001 work.
You talk to the tester
The person on the kick-off call is the person doing the testing, and you have a direct channel to them for the whole engagement.
Evidence, not guesswork
Every finding is ranked by risk, scored with CVSS (the industry severity scale) and backed by evidence you can reproduce. Nothing unconfirmed goes in the report.
Scope built around you
No generic checklist. We agree scope, rules of engagement and written authorisation before anything is touched, and we test what you agreed to and nothing else.
Safe and controlled
No denial of service, no destructive actions, no changes to production data. Agreed testing windows, and critical findings reported the moment they are confirmed.
We stay after the report
A debrief workshop, remediation guidance and a retest of the key findings are part of the job.
Track record
Offensive security work across Croatia and the Netherlands
Luka and Fady have tested organisations across the full range of size and sensitivity: small municipalities, companies with a few hundred employees, national government agencies and multinational enterprises.
The work has ranged from a single web application penetration test to red team operations lasting months, testing technology, people and processes together.
Book a free intro callBeyond paid work
Responsible disclosure, done in good faith
If we contacted you about a weakness in your system, this is how we work.
When we come across a weakness in a system that is not ours, we never exploit it. We go no further than needed to confirm it is real, and we never access or copy anyone's data. We document it and tell the owner privately, so it can be fixed before someone with worse intentions finds the same door.
This follows the EU principles of coordinated vulnerability disclosure and the direction of NIS2, and we always give the owner a fair window to fix it.
We do it because a flaw that is quietly fixed cannot be sold or used for ransom. It also shows what a determined attacker could do with more time. And it is a fair sample of our work: a real issue, found without any of the access a paid engagement gives.
We hope owners take it seriously and fix it. Where a bug bounty exists, recognition is welcome, and we are always glad to talk about working together. None of that is a condition: we ask for nothing in return.
Sister company
ReactiveZero and the AI testing platform
Luka and Fady also run ReactiveZero, an offensive security company based in the Netherlands: same founders, same way of working, a company in each country.
Obventum and ReactiveZero together run four NVIDIA DGX systems in our own environment, training and running a local offensive security model. An AI assisted penetration testing platform built on it is in beta. Every result is validated by a human tester, and client data never leaves hardware we control, which is why it runs locally.
© 2026 Obventum d.o.o. All rights reserved
Developed by Reakt Studios
