Founder and penetration tester  •  AI-assisted offensive security  •  Manchester, UK 🔐

name: Robert Huzo
role: Founder and lead penetration tester, HuzoSecurity Ltd
building: NullCadre, an AI-assisted penetration testing and bug-hunting platform
also: HuzoHunter AI, a local-first defensive threat-hunting platform
principle: The engine proves the facts. The AI reasons about them. The model never decides whether a bug exists.
focus: Web and API testing · Authorisation (BOLA/IDOR/BFLA) · LLM application security · Security automation
certs: CompTIA Security+ · CompTIA A+ · EC-Council CEH (5-day hands-on training)
bounty: HackerOne · Bugcrowd · Intigriti · YesWeHack · WordFence

• 🛰️  Building and running NullCadre, used daily on authorised engagements and bug bounty targets
• 🛡️  Building HuzoHunter AI, the defensive counterpart, for organisations that can't ship telemetry to a cloud vendor
• 📄  Read a full worked assessment with the evidence behind every finding
• 🎓  BSc Cyber Security, Solent University (in progress) · NVIDIA Inception member
• 💬  Ask me about authorisation testing, LLM attack surfaces, and running AI models locally
• 📫  Reach me at robert@huzosecurity.com or via huzosecurity.com

flowchart LR
    T["🎯 Authorised<br/>target"] --> G{{"🚦 Scope gate<br/><code>scope.gate.validate()</code><br/><i>fail closed, in code</i>"}}
    G -->|"out of scope"| X["⛔ Refused<br/><i>no packet leaves</i>"]
    G -->|"in scope"| D["🔬 Deterministic battery<br/>526 modules, exhaustive"]
    D --> E[("📊 Evidence<br/><i>graded, structured</i>")]
    E --> H["🧠 Hunter · local LLM<br/>observation → hypothesis<br/>→ probe → pivot"]
    H -->|"new leads"| G
    E --> V{{"✅ Confirmed out of band<br/><i>working proof of concept</i>"}}
    V -->|"could not run"| N["⚠️ NOT TESTED<br/><i>with the reason</i>"]
    V -->|"proven"| R["📄 Report · 8 formats"]
    N --> R

    style G fill:#7c3aed,stroke:#5b21b6,color:#fff
    style X fill:#dc2626,stroke:#991b1b,color:#fff
    style H fill:#be123c,stroke:#9f1239,color:#fff
    style N fill:#d97706,stroke:#b45309,color:#fff
    style E fill:#0891b2,stroke:#0e7490,color:#fff

How it works

• A deterministic battery runs first, every applicable detector, exhaustively. Each finding carries structured evidence and a grade.
• An operator-enabled Hunter (a local LLM) then takes those findings as its starting knowledge and builds a real attack chain: observation, hypothesis, probe, pivot, evidence. It can only add to the baseline, never reduce it, and CI tests assert that on every build.
• Every action, from recon to confirmation, passes a fail-closed scope gate enforced in code (scope.gate.validate()) before a packet leaves. No prompt-based trust, no bypass, no trusted mode.
• Criticals are confirmed out of band with a working proof of concept. Anything that could not run is reported as NOT TESTED, with the reason, never as a clean result.

Numbers

• Under 5% false-positive rate, measured across several public vulnerable applications, a published authorisation-testing benchmark, and a fully patched self-hosted target where the correct answer is nothing found
• 526 integrated scanner and tool modules · 156 Hunter actions · 8 report formats (HTML, PDF, Markdown, CSV, JSON, SARIF, OCSF, executive one-pager)
• Runs entirely on the operator's estate. No target data leaves the machine, including for report narration.

Nothing runs out of scope.

Principles

Report impact, not observations. Absence of evidence is not evidence of absence. Never say "fixed"; the strongest honest claim is "not rediscovered". Confirm, don't weaponise: no persistence, no credential dumping, nothing destructive.

🔒 The core repository is private and proprietary to HuzoSecurity Ltd. The platform runs behind a HuzoSecurity engagement; it is not sold or licensed.