We find the issues before someone else does.
Security testing by people who write production code. The findings arrive with remediation your team can merge, because we have had to merge it ourselves.
Credentials
DEF CON
Black Badge
Awarded to winners of DEF CON’s hardest contests. It cannot be bought, studied for, or renewed, and there is no continuing-education requirement attached to it, because the work that earns it is not the kind you can cram for.
Arkamind’s principal, Artem Kamshilin, holds one — won on Dark Money at DEF CON 34, one of ten contests that year authorised to award a badge. It came after eight years competing on CMD+CTRL ranges.
The target was a digital banking application. Artem built an AI-backed harness to parallelise attack-surface enumeration across it, and the badge came from vulnerabilities the organisers did not know were there.
The hardest challenges were not the ones that fell to automation. Those needed judgement — recognising unusual behaviour, interpreting earlier findings, forming new hypotheses. That division of labour is what we bring to client work.
Interview with the contest organisers- DEF CON Black Badge
- 2026
- Years shipping production software
- 28
- Years in security research
- 23
Engagement types
Application penetration testing
A defined scope, tested by hand, with source access where you can give it. Every finding is one we confirmed ourselves and can reproduce for you.
Vulnerability research
Original research into software you depend on or software you ship. Findings go through coordinated disclosure, and you decide what gets published.
Architecture and threat-model review
Before the code exists, when changing the design still costs nothing. Frequently the highest-value thing we do.
Post-incident analysis
What happened, how far it went, and what has to change. Written so your engineers can act on it and your counsel can live with it.
What you get
A report your engineers will actually open twice.
- A finding for every issue, with the reproduction steps and the evidence behind it.
- A severity rating we can explain and justify, rather than a number copied off a scanner.
- Remediation written by someone who has shipped the fix before.
- A retest of everything you remediate, included in the engagement.
- A debrief call with your engineers, not only with your CISO.
Disclosure
What we find in your systems stays yours.
Nothing from an engagement is published without your written permission. Coordinated disclosure applies to our own independent research — into software we use or ship, never yours — which goes to the affected vendor before it goes anywhere else.
If you have found something in one of our own properties, our security.txt and PGP key are live. We write these reports ourselves, so yours will reach someone who can act on it.
inquiry@arkamind.com
Tell us what you are worried about.
Scoping calls are with the person who would run the engagement. We will tell you if a test is the wrong instrument for the question you have.