Skip to content

Practice

What the work is actually about.

NIIS 9 is not a generalist pentest mill. The practice is built around systems that move, broadcast, and carry identity through radios that product teams rarely put on the diagram, and around the public footprint those systems leave behind.

Wireless & RF

Enterprise Wi-Fi, BLE product ecosystems, cellular attachment, and undocumented ISM-band protocols. The question is not “is WPA3 on.” It is who can sit in the collision domain and what they can become. Open 02

Mobile platforms

Application security with the radio on. Platform attestations, local storage, IPC, and the third-party SDK that requested Bluetooth permission “for analytics.” Open 03

Privacy engineering

Whether a design that claims unlinkability still yields a stable person at the air interface, the advertising ID, or the support log. Open 04

OSINT & exposure

Adversary rehearsal from public sources. What wardriving datasets, certificate logs, shipped builds, and conference photos already say about you, and how to make them say less. Open 05

Threat modeling

The spine of the practice. If the model cannot name the adversary and the boundary, testing is just expensive wandering. Open