Nothing annoys us, as attackers, more than well placed honeypots/tokens. It makes us paranoid at every step. That's good! 👇

🧪 Volkis Lab: What attack can you perform here? In this code, nothing is executed, dropped or broken. Yet, there are multiple attack possibilities.   The important thing is how you think. Drop your thoughts below 👇🐺

It took us months, but we're in. And now it's time to pull the trigger. We'll go in fast, hit our goals, and leave. At 7pm no one's around right? It works! The 6 of us get our goal in an hour. Turns out, no one was "officially" on call. An easy mistake to make🐺 #HackingStories

🧪 Volkis Lab: What’s the attack? A good attacker knows what their activity looks like in logs. Here, everything looks legit, but it's not. Bonus: What tools would you use to perform it? Drop your answers below 👇🐺

Everyone thinks attackers start by cracking passwords. Most of the time, we don’t. 🐺 We relay NTLM authentication instead. You authenticate to one system → we relay that authentication attempt to another system. No passwords needed. #VolkExplains

🧪 Volkis Lab: The Validation Trap The code looks clean. It checks the protocol. It checks the hostname against an allowlist. On the surface, it’s "safe." What part of the URL are we forgetting to validate?  Drop your answers below👇

Do you think your SIEM alerts will catch a brute force attack? Some of the ways to try and remain undetected: 🐺 Low-and-slow attempts 🐺 Valid Usernames. 🐺 Distributed IPs If you are waiting for a spike in the dashboard it may never come. #VolkExplains

"G’day, it’s IT. Just hit 'allow' so we can fix that sync error." Marketing was in a rush and just wanted to be helpful. One click later, we were them. Who needs fancy exploits or zero-days when the system trusts the user, and the user trusts the attacker? 🐺 #HackingStories

Think your 1970s mainframe is safe? Think again Our attackers used evasion techniques to bypass detection and compromise a major insurance company's legacy IBM system, the "Gibson"; we found the master customer data table and executive PII. Contact us today to learn morw

Is your security ready for a full-on, extended attack? The Volkis Red Team uses tailored infrastructure and social engineering over weeks to target your core services. Watch how we went from an initial block to gaining full data access via a simple printer account👇

Wakey Wakey, Volk! Back to work from the holidays... or maybe just 5 more minutes? It's #mascotmonday! 🐺

Volk pondering his New Year's Resolutions 🐺👇 #mascotmonday

Volk loves a Monday morning cuddle! 🥰🐺 #mascotmonday

We are MIA until Monday 🌴 Volkis & Family are heading away today to the Hunter Valley for the next three days to enjoy Hacker house. We are looking forward to swimming, walking tracks, botanical gardens, Christmas lights and maybe some vino! 🍷🍇 Back Monday 🐺

Just stay in bed today.  From Volk 🐾 #mascotmonday

Being a hacker means being a part of a team! Its not a solo sport. (with 🖊 Alexei Doudkine at BSides Canberra with Ricki Bourke)

Is your security a quick fix or a long-term roadmap? We'll help you define a 3-5 year security strategy that aligns with your business goals. Stop wasting money, start enabling growth. Ready for a plan that lasts? Learn more about our advisory services.👇 https://tinyurl.com/yadb8atn

Volk's new favourite cafe is called XS Espresso!  Or... XSS-presso. He eats vulnerabilities for breakfast 🥞 Coincidence? I think not! 🐺 #mascotmonday

The Taylor Swift concert hype in Australia gave us the perfect cover for our phishing campaign as a part of a Red Team: Operation TayTay.  We can use current events to test and strengthen your users' security awareness program. #SocialEngineering #Volkis #RedTeam

Cloud environments are complex, but a potential compromise doesn't have to be devastating. We harden Microsoft 365, AWS, and Azure beyond checklists to drastically lessen the impact of a compromise.  Ready to secure your cloud? Learn more about it👇 https://tinyurl.com/2yjsycvk

Do you know the CIA Triad? It’s the foundation of security: 🐺 Confidentiality – keep data private 🐺 Integrity – keep data accurate 🐺 Availability – keep data accessible Balancing all 3 helps you manage risk. Learn more 👉 https://www.volkis.com.au/blog/cyber-security-basics/

Happy #Mascotmonday to everyone that didn't want to get out of bed this morning! Sorry Volk might be late this morning! 🐺

Is your security posture built on a generic checklist or real-world experience? Our Secure Config Reviews are based on industry-recognized guides plus our own checks built from years of penetration testing experience. Learn more: https://www.volkis.com.au/services/secure-config-reviews/

"Our security sucks, so why bother with a pentest?" 🤔  A good test is more than a bad report. It’s a prioritized roadmap showing execs exactly what to fix and helping them turn known problems into a clear plan.   Read our blog! 👇 https://tinyurl.com/3wbf9wyv

True security is about more than just compliance, it's about aligning your defenses with your organization’s strategic goals. We help you achieve your objectives while building a greater level of security for a lower cost. Learn more here👇 https://tinyurl.com/yadb8atn

Happy Birthday Josh! 🎂🥳🎉 We hope you have a great day! Lots of love your Volkis Family ❤️

Join us in wishing a very spooky halloween and welcome to Jasie, our newest team member! 🎃🐕 Her official job title is Supervisor. Favourite activities include: - Threat Hunting (for bikes) - Security Testing (biting ankles) - Compliance Monitoring (sniff testing) Welcome!

We’re excited to share that Alissa Borg will be presenting at #BSides Sydney next week! Alissa and her co-presenter, Paula Sillars, will be leading an important and empowering discussion: "Breaking the Mould: Women Thriving in Technical Roles"

A critical cyber risk for one company isn't always a priority for another. For example, while data integrity is critical for a hospital, the theft of intellectual property is catastrophic for a military R&D firm.  Want to learn more? Read this👇 https://www.volkis.com.au/blog/cyber-security-basics/

The Volkis team is heading to New Zealand next week for Kawaiicon! The Volkis team will be in Wellington from Nov 5th to 8th attending Kawaiicon. If you're attending, let us know!👇 We can't wait to catch up with everyone. 🇳🇿 More about the event here: https://kawaiicon.org/

🐺 #mascotmondays on tour! 🚗💨

We did it again! ⭐️ ⭐️ ⭐️ ⭐️ ⭐️  "Volkis are knowlegeable, professional and an essential part of our security mix" - CEO of Sports Technology SaaS Company in Australia! If you're in Australia and need local cybersecurity services, get in touch today: https://www.volkis.com.au/contact/

Matt flew in from Sydney, Hortense from Melbourne and both Andy & Alissa braved the motorway for lunch in sunny Brisbane! We made sure to load Alissa up with a ton of Volkis merch, a lock picking kit, a networking testing device & the coveted Volkis beer glass!! 🐺

I asked Volk for his favourite fuzzing tool. But all I got was fluff. #mascotmondays

Breaking into infosec is tough. Most entry-level CVs get ignored. In this talk, Volkis co-founder Alexei Doudkine shows how to social engineer your way in. Watch now 👇 https://www.youtube.com/watch?v=Jpcj8eyFpTA

Today we welcome our newest addition to the Volkis team. Please meet,  Alissa Borg,  our newest Associate Security Consultant. Alissa's passion for hacking is off the charts. We're thrilled to have you joining us, Alissa! 🐺

This post says it all! Reach out to our Relationship Manager Hortense if you are around Melbourne next week 🐺

Planning a penetration test? You've got a big decision to make: should you allowlist the tester and let them bypass your security controls? What's the right call?  Read our complete blog to find out👇 https://www.volkis.com.au/blog/allowlisting-a-penetration-test/

A standard penetration test can leave you with a long list of vulnerabilities. We ensure you get the most from your testing with these value-added options, designed to help you not only find vulnerabilities but also understand and fix them. Learn more: https://tinyurl.com/3b7y6w2p

Many think usernames & passwords are enough, but reset links, help desks, or lost phones can be the real weak spots. Learn how attackers exploit “abnormal” events, why mapping all auth paths matters, and how to spot the easiest way in. Read our blog! 👇 https://tinyurl.com/authenticatevolkis

That moment you realise your alarm didn't go off! #mascotmondays

Generic training isn’t working. A 2025 study found that mandatory phishing awareness courses had almost zero effect on reducing failure rates in simulated attacks. Volkis does things differently. Find out more and book your test today 👇

We have some terrible news. 😔 Our NEW stickers did not arrive in time for @bsidescbr.bsky.social. But if you see one of us, come say hi right away and let us know that you want the stickers when they arrive! I don't want to spoil the design, but... hacking in the dark will become a lot cooler! 😎

Vulnerabilities that put your business at significant risk are not only damaging for you, they could have an impact on your employees and your customers. Don't wait for a breach to find your weaknesses. Learn more now 👇 https://www.volkis.com.au/services/offensive-security/

Why use dig, when you can use dog instead? 🐺 #bash101 Install dog here 👉 https://github.com/ogham/dog

Having a slow Monday? Here are two dogs having a wrestle!👇 #mascotmonday

One week left until @BSidesCbr! 🚀 BSides Canberra 2025 is on next week (25–27 Sept) - There's still time to grab a ticket: https://www.bsidesau.com.au/

30 years today since "Hack The Planet" was first shouted out of a police car! 🎉 What's your favourite scene?

Automated pentests? If It sounds too good…

Another happy customer! ⭐️⭐️⭐️⭐️⭐️