012 weeks
Fail-Open Audit
Fast proof for your wallet flow or verifier: signature verification, nonce and audience binding, trust-list fail-closed behaviour, revocation and over-asking. A ranked findings memo, ready to act on.
Offensive security for Europe's digital identity wallets
One setting silently
turns off trust.
We find it first.
What we do: independent penetration testing of the identity path — we find the flaw before an attacker does.
Independent offensive security for the European Digital Identity Wallet. We attack OpenID4VP, SD-JWT and mdoc for KYC and identity providers building verifiers, and banks and PSPs accepting them by 2027.
to relying-party acceptance
IDENTITY / TRUST BOUNDARY 01—27
TRUST IS A CHECK. NOT AN ASSUMPTION.
A sample digital-identity credential, shown for illustration only.
INDEPENDENT BY DESIGN
eIDAS 2.0AMLR-readyDORA-aligned15+ years in eID, KYC and AML
01The pattern
Trust that fails open is worse than no trust at all.
Every national wallet forks shared reference code; every verifier builds on it. The dangerous failures are often trust checks shipped switched off or optional: an unverified signature, a missing setting, a policy that accepts what it should reject. The verifier reports success while accepting a forged identity. That is fail-open trust. We hunt it before it reaches your customers.
ILLUSTRATIVE / FAIL-OPEN
Untrusted identity
VERIFIED ✓
TRUST CHECK: OPTIONAL
An illustrative trust check that accepts an identity without verifying it.
The fraud of the wallet era won't be a fake passport.
It will be a verifier that said yes when it should have said no.
02Services
We break the identity path
so no one else can.
Four engagements for Europe's KYC and identity-verification vendors, wallet hubs, verifier providers, and DACH banks and PSPs: a two-week proof through to a standing retainer. Fixed scopes, senior operators, file-and-line proof — never a maturity score.
024–6 weeks
Identity-Path Security Test (IPST)
Deep testing of the whole wallet flow: OpenID4VP, SD-JWT VC, ISO 18013-5 mdoc, COSE/JOSE and the trust chain. Findings proven at source, mapped to AMLR customer due diligence and DORA, in a board-ready evidence memo.
036–16 weeks
Integration Advisory
Review and harden protocol choices, verifier configuration and fallback design before you ship. We show where your integration breaks. We advise and test; we don't build it.
04ongoing
Assurance Retainer
Testing that keeps pace with your releases: every version checked, a retest calendar, and a signed assurance letter your own clients can rely on.
SUPPORTING CAPABILITY
Compliance & GRC support
Readiness and evidence for the standards your buyers demand — DORA, ISO/IEC 27001, SOC 2 and GDPR — run by the same senior bench, so your security testing and your compliance story come from one team.
Independent by design. We never build a wallet, hub or verifier — so we can test everyone's.
03Who we work with
For KYC & identity providers
You're shipping a wallet verifier your bank clients will scrutinise. We test it before they do — and give you an assurance letter you can hand to every prospect.
For banks & PSPs
You must accept the EU wallet by 2027 and prove to your auditor it's secure. We test your integration end to end and map every finding to DORA and AMLR.
For wallet hubs & verifier vendors
One weakness in your hub reaches every client on it. We test the trust chain at the core, independently.
How an engagement works
- 01
Scope
One call, a fixed scope and fixed price.
- 02
Test
Senior operators test the identity path at source level.
- 03
Prove
A ranked, file-and-line evidence memo mapped to DORA and AMLR.
- 04
Retest
One free retest within 90 days to confirm fixes.
What you get
A ranked findings memo with proof you can trace to the source and real-exploitability ratings; a remediation retest; and, on a retainer, a signed assurance letter for your customers and their auditors. Evidence, never a maturity score.
04The wedge
Everyone tests the app.
We break the trust chain.
Generalists excel at web and mobile but treat wallets as login screens. Crypto-audit houses know protocols, not your MLRO or auditor. We bridge that gap with deep wallet-protocol testing, bank and AML fluency.
CITIZENWALLETVERIFIERBANK
Protocol-fluent.
We test OpenID4VP, SD-JWT VC, mdoc and trust-list implementations at source level, with findings documented for each engagement.
AML-literate.
Every report speaks to customer due diligence and DORA, not just CVSS. 15+ years in eID, KYC and AML sit behind it.
Independent.
We build nothing in the ecosystem, so our word carries — to your board, your auditor and your clients.
Relentless on proof.
File and line, reproduced by senior operators. If it doesn't survive verification, it doesn't ship.
Every finding mapped to DORA, ISO/IEC 27001:2022, SOC 2, GDPR, BSI C5, ISO/IEC 42001 and PCI-DSS: evidence for your board, regulators, customers and auditors, not a raw CVSS list.
05Evidence
Clear checks.
Sources you can inspect.
Eight verifier checks, source standards and questions for buyers. Our public reference explains our testing focus; it is not a record of disclosed vulnerabilities.
Eight checks for the identity trust chain.
Signature verification, nonce and audience binding, trust lists, revocation, holder binding and more — with source links and questions for your verifier vendor.
Read the trust-chain reference →Team experience & focus
3
protocols we live in: OpenID4VP, SD-JWT, mdoc
15+
years in eID, KYC and AML
2
national digital identity systems our team helped build
2027
the year Europe must be ready
“Proof at source level,
not a maturity score.”
06Why now
A continent is re-plumbing identity.
The window is open once.
EU member states must offer wallets by end 2026; banks and regulated firms must accept them by end 2027. The AML Regulation applies in July 2027. KYC providers racing to become verifiers will face the same tender question: prove it is secure.
+
Today
wallets in pilot, verifiers shipping
+
End 2026
member states must provide wallets
+
Jul 2027
AML Regulation applies
+
End 2027
banks must accept the wallet
2030
the default has been chosen
The firm that owns this work by 2027 is still the default in 2030.
07The act of testing
We find it first.
Illustration of what our testing surfaces — synthetic data, no real systems.
ILLUSTRATIVE / CROSS SECTION01 — 04
01 / IDENTITY02 / ISSUER PROOF03 / HOLDER BINDING04 / TRUST POLICY
CITIZENWALLETweak point surfacedVERIFIERBANK
A sample credential separated into layers to show where a trust check can fail.
08Who we are
We helped build national identity. Now we break it — so it holds.
Built by people who were in the eID room before it was a market.
Founded on 15 years in electronic identity, KYC and AML. Our team has helped build two national digital identity systems from the inside. Deliberately small, deliberately deep: senior operators with national-scale build and break experience, not a sales layer.
Independent · Senior-only · Evidence over opinion · Diplomatic by default, precise always
Senior operators, named on every engagement.
A named lead with verifiable certifications on every engagement, backed by combined decades in penetration testing, cloud security, DevSecOps and incident response. Senior offensive-security and compliance operators, not anonymous staff augmentation.
- OSCP
- CISSP
- CISM
- CRISC
- CCSK
- ISO 27001 Lead Auditor
- GCIH
- GCFA
- CEH
- CKS
- Offensive Security
- Compliance & Risk
- Cloud Security
- Infrastructure
- DevSecOps
- Incident Response
Before we get started
We already have a penetration tester.
They test your app and infrastructure. We test the identity trust chain most generalists treat as a login page — OpenID4VP, SD-JWT, mdoc, trust lists, revocation. We complement your existing testing, we don't replace it.
Isn't the EU wallet secure by default?
The standards are strong. The risk is in your verifier's configuration and fail-open defaults — which is exactly what we test.
How is this different from our DORA test?
DORA covers your ICT estate broadly. We go deep on the wallet and identity path, then map our findings straight back to your DORA and AMLR obligations.
Do you need access to production?
No. We scope access to the minimum needed — flow, spec, or staging — always under NDA and handled under our ISMS.
How fast can you start?
Fixed-scope audits start quickly, and one senior operator replies to every enquiry — not a form robot.
09Contact
Fixed scope. Fixed price. Senior-only. NDA-first. One senior operator replies.
If your wallet flow goes live in 2027, it should be tested in 2026.
Shipping a verifier or preparing to accept the wallet? Send us the flow you're worried about. One senior operator replies, not a form robot.
[email protected]