Offensive security · Competitive intelligence
GreyFern maps what a competent adversary can already learn about you from the outside — under signed scope, before you move on it.
Most organizations don't actually know what a competent adversary can learn about them. And most firms that offer to tell them go loud, or hand over a scan report and call it intelligence.
What GreyFern does
We map an organization's real structure — its people, its exposed systems, its habits — and the gap between what it believes is private and what is sitting in the open for anyone who knows how to look.
We do it under strict authorization, working exactly as far as the client signed off and not one step further. Most of what a client needs is already exposed; the discipline is reading it correctly, corroborating it, and never once being seen looking.
We are privately held and independently operated. We take only authorized work, under signed scope — and we turn down more engagements than we accept.
Service lines
No-touch collection, footprinting, and exposure assessment. We show you exactly what an adversary can already see from the outside — without touching a single production system.
Typical client needTell me what we're leaking.
The intelligence groundwork that precedes an active security test — org structure, access windows, attack surface. The recon operator's package becomes the active team's plan.
Typical client needMap the target before we test it.
Authorized active engagements that model a real threat actor end to end — under written rules of engagement, with every step recorded and every artifact accounted for.
Typical client needProve whether we can be breached.
Pre-acquisition, partnership, and third-party-risk research. A decision-grade picture of a target organization's real ownership, history, and undisclosed exposure.
Typical client needTell me who I'm really dealing with.
The house method
Our method mirrors how a frond grows — from the base, into the space available. Five steps, run in order.
Gather everything the target has left exposed: websites, filings, directories, calendars, data feeds — and the people who talk.
Cross-reference every source against every other source. Where the press kit, the live site, and the API disagree, that gap is the finding — not a nuisance to smooth over.
Where a source is incomplete, find the structured version a GUI won't show you: the undocumented endpoint, the next page of results, the raw file the browser won't render.
Decide what matters and what it means for the client's decision. A pile of sources is not intelligence until someone has weighed it.
Hand the client an accurate, sourced, decision-grade picture — every claim corroborated, every artifact traceable to where it came from.
Contradiction is signal
Sources always disagree. Amateur collection picks a winner and moves on. We treat the disagreement itself as the intelligence — and chase it until the picture holds.
The Frond Doctrine
Every operator is drilled on them before they touch a live engagement. Discipline — not talent — is what separates a clean engagement from an incident.
An engagement without an authorization letter does not exist. No exceptions, no favors, no “just this once.”
An operator who exceeds scope has failed the engagement, regardless of what they found.
Most of what a client needs is already exposed. The craft is in reading it correctly.
We leave as little trace as the objective allows, and never more than the client authorized.
We cross-reference until the picture holds. Where sources disagree, the disagreement is itself intelligence.
If an operator lands outside authorization or a client's real-world safety is at risk, they stop and escalate immediately.
Every engagement begins with a scoped conversation. We take only authorized work — and we'll tell you straight if what you need can't be done inside the lines.
Start an engagement inquiry