Independent security practice, Switzerland
Practical social engineering training and focused penetration testing for organizations that need people and controls to perform under pressure.
Human risk
An urgent payment request, a familiar voice or a routine login prompt can create the opening that technical controls were meant to prevent.
Readiness comes from realistic practice, clear verification habits and a reporting path people can use when a decision feels urgent.
Engagements
Two focused offers cover the human and technical sides of exposure. Scope, delivery and the decision that follows are made explicit before the work begins.
Primary engagement
A focused program combining scenario-led training and role-specific simulations. It prepares teams for impersonation, voice-based attacks, MFA abuse, payment fraud, malware delivery and the decisions that make those attacks succeed.
Teams practice how to recognize, verify and report manipulation under pressure.
Explore social engineering readinessTechnical validation
Manual-first testing across web applications, APIs, external exposure, internal networks and Active Directory, with clear boundaries and reproducible evidence.
Prioritized findings, remediation context and an optional retest.
Explore penetration testingWorking principles
Objectives, assets, participants, exclusions and decision criteria are explicit before testing or training begins.
Sensitive exercises require written authority, agreed contacts and a clear escalation path.
The person who scopes the engagement remains involved in delivery, analysis and the final readout.
Management receives clarity. Technical teams receive enough context and evidence to move forward.
About the practice
in7ruder is a founder-led security practice built around careful scoping, direct communication and personal responsibility for delivery.
My background combines building web applications with studying how attackers abuse people, identity and technical weaknesses. That perspective keeps human behavior and technical controls connected in every engagement.
Work stays intentionally focused. If a broader team is ever needed, that is made clear before the engagement begins.
Matias Vanarelli, Founder
View background on LinkedInCommon questions
Training can be designed for the wider organization or adapted to roles with greater exposure, including finance, executive support, IT, customer service and operations.
Yes. The engagement begins with context. Scenarios are selected around relevant workflows, communication channels and threat patterns without exposing sensitive internal information unnecessarily.
The purpose, authorization, data collected, reporting level and retention period are agreed before delivery. The default approach favors aggregated learning and practical improvement over individual blame.
The proposal defines the exact assets, methods, exclusions, testing window, reporting format and retest conditions. Findings include enough context and evidence for teams to reproduce, prioritize and remediate them.
Yes. A workshop or tightly scoped assessment is often the right way to establish priorities and working fit before committing to a broader program.
Start with context
Twenty minutes is enough to understand the situation, establish whether there is a fit and identify the next sensible step. I reply within one business day.
