—
Global Operators
Zone A · Assessment LayerAuthorized Security Assessments
If it can be exploited,
we find it first.
A verified security-researcher network operating under written authorization, defined scope, evidence controls, and client-ready reporting.
HUNT · The Thesis
The workflow layer for authorized security assessment.
HUNT is a compliance-first assessment platform — coordinating verified researchers, client-approved scopes, evidence records, triage workflows, and reports. Every engagement is bounded by written authorization and rules of engagement.
—
Red Team Specialists
—
Countries
—
Deployment SLA
Capabilities
No vulnerability survives long enough to become a threat.
Full assessment workflow — from intake and scoping to evidence, triage, remediation tracking, and final reporting.
HC.01
Pentest → 0-day → Exploit Chain
Full spectrum: reconnaissance, vulnerability discovery, controlled validated security testing, and kill-switch management — delivered as a single operational service rather than fragmented engagements.
HC.02
Human + AI Attack Intelligence
AI-orchestrated red team campaigns mutate and retry attack chains at scale. Human operators command every decision point — autonomous tooling never executes without judgement in the loop.
HC.03
Verified Researcher Network
Pre-vetted, contract-ready researchers across regions. Engagements require client authorization, scope, and applicable legal review.
HC.04
Adversary Pursuit & Neutralisation
Active pursuit of APT infrastructure, command-and-control pre-emption, and controlled takedown of hostile assets — before they strike. Coordination with IFC0 fusion cells for handoff.
HC.05
Responsible Vulnerability Research
Curated vulnerability research handled under responsible disclosure, retention controls, and client-approved remediation workflows.
HC.06
Cyber Range & Wargaming
Full-fidelity adversary emulation environments for defender training, doctrine validation, and capability benchmarking — including continuous red-team-as-a-service against your own infrastructure.
Operational Metrics
Operating at nation-state scale.
10,000+
Network Size
Global security researcher network — vetted, contract-ready, deployable on demand.
4,000
Red Team Core
Specialists trained in authorized assessment across cloud, mobile, ICS/OT, and bespoke environments.
60+
Geographic Reach
Countries with active operator presence and jurisdictional legal cover.
72h
Deployment SLA
From engagement authorisation to operators on-target, including pre-cleared infrastructure.
24/7
Engagement Tempo
Follow-the-sun handoff between Dubai, Singapore, and Tallinn fusion centres.
Sov.
Clearance Posture
Operator background screening to government clearance equivalents in UAE, IN, EU.
Footprint
Where HUNT operates.
Regional operations coverage supports follow-the-sun assessment management, client communication, and evidence review.
25.2854°N · 51.5310°E
Dubai · CENTCOM
Primary operations centre. MENA, Africa, and Central Asia coverage with documented engagement authority.
1.3521°N · 103.8198°E
Singapore · INDOPACOM
Asia-Pacific hub. Engineering and tooling depth, large operator pool, integration with Epic Fury manufacturing.
59.4370°N · 24.7536°E
Tallinn · EUCOM
Europe and trans-Atlantic operations. Co-located with NATO cyber alignment and EU jurisdictional access.
Engagement Model
How working with HUNT begins.
Engagements move fast. Most principals are operational within ten working days of first contact, including all clearance and legal infrastructure.
01
Authorized Brief
Client intake covering assets, scope limits, testing windows, data handling, emergency contacts, and engagement authority.
02
Capability Match
Specialist team composition, infrastructure requirements, and operational tempo defined against the principal's specific objectives. Delivered within 72 hours of brief.
03
Authorisation & Legal
Scope, rules of engagement, researcher eligibility, and client authorization finalized before assessment work begins.
04
Deployment
Operators on-target within 72 hours of final authorisation. Continuous reporting cadence agreed upfront. Coordinated handoff with IFC0 fusion cells where intelligence overlap exists.
05
Continuous Operations
Long-term engagements maintain dedicated operator pools, persistent infrastructure, and direct line to principal command. Tempo and scope adjusted in real time.
Compliance & Authorization
Authorized by design.
Jurisdiction
UAE primary jurisdiction with operational presence under local legal cover in 60+ secondary jurisdictions. No five-eyes data residency.
Clearances
Researcher identity, proof, and eligibility review with continuous compliance monitoring where required.
Data Residency
Assessment data and evidence are handled with access controls, retention rules, encryption, and audit logging.
Disclosure
Vulnerability research is handled through responsible disclosure, client authorization, and controlled reporting.
Engagement Terms
Engagements require written authorization, scope, rules of engagement, and applicable legal review.
Audit
Full operational audit trail available to authorising principal. Independent oversight available on request.
Integration Thread
How HUNT connects.
HUNT integrates client intake, assessment workflow, evidence management, and secure communications into one reviewable process.
IFC0
Triggers HUNT operations from intelligence signal. The intent detector that activates the executor.
→
EPIC FURY
Physical extension of cyber operations — drones for cyber-physical targets and on-target presence.
→
Q-311
Secures HUNT communication channels with strong cryptography and controlled access.
→
Engage
Engage HUNT.
Capability briefs are conducted under confidentiality and authorization controls. Initial briefs require approximately 90 minutes; full engagement scoping completes within 10 working days.
Zone A · EnlistmentOperators Only
If you can break it,
we want you on the inside.
HUNT is a verified researcher network for authorized security assessments — structured scopes, paid engagements, evidence controls, and reputation built through reviewed work.
The Network · Why Enlist
A flag worth fighting under.
Many researchers want clearer scope, stronger authorization, and better evidence handling. HUNT provides a structured network where approved work, reputation, and client-ready reporting are connected.
—
Operators Enlisted
—
Active Red Teams
—
Specialist Domains
—
Intake → Decision
The Terms of Service · For You
What enlistment gets you.
This is not unmanaged freelance work. It is scoped, authorized assessment work with review, reporting, and progression.
OP.01
Written Authorization
Every engagement requires documented client authorization, rules of engagement, and scope boundaries before work begins.
OP.02
Paid On Capability
Engagement fees, artifact bounties, and standing retainers for ranked operators. Compensation tracks the scoring matrix — verified impact pays, noise does not.
OP.03
Identity, Protected
Pseudonymous researcher identity with a Verified Researcher Passport. Your handle carries reputation while sensitive identity data remains access-controlled.
OP.04
Real Scope, Real Evidence
Work on approved assets only, with controlled evidence submission, triage, and remediation tracking.
OP.05
A Ladder That Climbs
Recruit to Principal's Circle. Rank is earned on verified artifacts, not tenure. Climb the House leaderboard and unlock command-track engagements.
OP.06
Follow-the-Sun Crews
Plug into 24/7 handoff between Dubai, Singapore, and Tallinn. Operate in a crew, learn from leads, never carry an engagement alone.
Who We Enlist
We screen for judgement, not just skill.
“We do not enlist the loudest. We enlist the ones who can reach into hostile infrastructure, hold the access quietly, and know exactly when not to pull the trigger.”
HUNT Operator Doctrine · Clause 1Eleven specialist domains. Pick your ground, or prove you cross several: Cloud · Mobile · ICS/OT · Web · Hardware · Wireless · Social Engineering · Crypto · AI/ML · Comms · Embedded. Every applicant passes identity/proof review, technical validation, and ongoing compliance checks where required.
The Ladder · Progression
Rank is earned, never assigned.
Five tiers. You move on verified artifacts and engagement performance — scored, audited, and visible on the House leaderboard.
R-00
Recruit
Identity verified, proving engagement assigned. Sandbox and cyber-range access only.
Gate · Face Verification + Proving Task
R-01
Operator
Cleared for live authorised engagements within a crew. Earns artifact bounties and engagement fees.
Gate · 3 Verified Artifacts
R-02
Specialist
Domain-recognised. Leads on technique within a specialist domain; mentors recruits.
Gate · Domain Mastery + 25 pts
R-03
Crew Lead
Commands a crew across a follow-the-sun engagement. Standing retainer; direct reporting line.
Gate · Lead Endorsement + 75 pts
R-04
Principal's Circle
Trusted with high-sensitivity client assessments and advanced research workflows. Invitation only.
Gate · By Command Invitation
Scoring Matrix · How Points Work
Verified impact pays. Noise does not.
Fifteen artifact types across five categories. Every submission is reviewed by a lead, scored, and logged to your passport. Points drive rank, retainers, and House standing.
CategoryArtifactPoints
Recon
Verified attack-surface map / exposed asset inventory
2
Recon
Credential / secret exposure with proof of validity
4
Recon
Adversary infrastructure attribution package
6
Vuln
Confirmed vulnerability, low / medium severity
5
Vuln
Confirmed vulnerability, high severity
12
Vuln
Novel vulnerability, responsibly disclosed
40
Exploit
Working exploit (PoC) against authorised target
15
Exploit
Full exploit chain with controlled foothold
30
Exploit
Exploitability analysis with safe reproduction
50
Access
Persistent, deniable access established
25
Access
Lateral movement to objective system
35
Access
Command-and-control pre-emption on hostile asset
45
Effect
Controlled takedown, fully documented
60
Effect
Tooling / automation contributed to the arsenal
20
Effect
Mentorship artifact — recruit advanced to Operator
10
Houses · Live Standing
You don't operate alone. You operate for a House.
Every operator is drafted into one of four Houses. Your artifacts add to your House total; the standing resets each operational quarter. Sample standing shown.
I
Rank 01
House Saber
First in, last seen.
48,210 pts
II
Rank 02
House Cinder
We burn the path.
40,775 pts
III
Rank 03
House Vantage
See everything. Say nothing.
34,002 pts
IV
Rank 04
House Ophir
The quiet hand.
30,118 pts
Operator Identity · The Passport
One credential. Total cover.
PENDING ISSUANCE
FIIVE EYES · VERIFIED
RESEARCHER PASSPORT
RESEARCHER PASSPORT
TYPE · HNT
Handle
— — —
House
Unassigned
Rank
Recruit
Domain
Pending
P<HNTFIIVE<EYES<<OPERATOR<<<<<<<<<<<<
HNT0000000<0AE2600000M<<<<<<<<<<<<04
HNT0000000<0AE2600000M<<<<<<<<<<<<04
The 3D Verified Researcher Passport is your identity inside the network.
ICAO-9303-compatible machine-readable zone. Front carries your handle, House, rank, and domain; back carries your verified artifact log and clearance posture. It is the only thing that travels — your real identity never does.
- Pseudonymous by default · sensitive identity data access-controlled
- Live artifact and points ledger bound to the passport
- Downloadable once issued · revocable on clearance change
- Begins in Pending Issuance state until your proving engagement clears
Enlistment · Seven Stages
How you get in.
The portal moves fast and screens hard. Most applicants reach a decision within 72 hours of completing intake.
01
Intake
Encrypted application. Declare your domains, jurisdiction, and the work that proves you. No CV theatre — evidence only.
02
Identity Gate
Face-verification gate establishes a single human behind a single handle. Your real identity is sealed; your handle is born.
03
Proving Engagement
A scoped, sandboxed task against a HUNT cyber range. We watch how you think, not just whether you land it.
04
Clearance Screen
Background and eligibility screening under documented compliance protocols. Continuous monitoring begins here.
05
House Draft
You're drafted into a House and matched to a crew lead. Your passport issues from Pending into active state.
06
First Engagement
Cleared for live authorised work inside a crew. Your first verified artifacts hit the ledger.
07
Standing Operations
Climb the ladder, build your House total, and unlock retainers and command-track engagements.
Enlist
Enlist in HUNT.
Intake is encrypted and screened under compliance controls. Applicants reach a decision target within 72 hours. If you can assess it responsibly, prove it.