Find the unknown vulnerabilities (zero-days) before attackers do.
We research your product or system for vulnerabilities nobody knows about yet — zero-days. Combining formal verification, fuzzing, and manual analysis, we surface unknown weaknesses that known-CVE matching can't find, so you can close them before an attacker exploits them. Anything we find is reported only to you, under a responsible-disclosure policy. We only research software and systems you own or are clearly authorised to test.
Matching known CVEs can't stop unknown vulnerabilities
A vulnerability scanner matches already-published CVEs —
flaws someone else already found. The truly dangerous ones are the unpublished vulnerabilities that exist only
in your product. This service is built on the idea of formalizing
vulnerabilities as formulas: we systematically search for the counterexample an attacker looks for,
∃x ¬Safe(P, x), and find the unknown vulnerability first. Combining automated fuzzing, manual
analysis, and — where it pays off — formal verification (symbolic execution, SMT), we report findings with
reproduction steps and fixes.
Three plans by research scope (¥500,000–¥3,000,000)
Every engagement is quoted to the scope and complexity of the target. The figures below are standard guide prices (excl. tax). There is no online payment — please start with an inquiry.
- One target (web app, API, native app, library, etc.)
- Fuzzing + manual code review
- Focus on memory safety and injection paths
- Reproduction steps and fixes for each finding
- Spans multiple components and features
- Counterexample search via symbolic execution / SMT
- Logic review of auth, permissions, state machines
- Detailed report under responsible disclosure
- Analysis from both source and binary
- Includes dependencies (OSS/SBOM) and build path
- Formal verification of key components (MC/SMT)
- Executive report and remediation roadmap
* Research is performed only on software and systems you own or are clearly authorised to test. Findings are never disclosed or sold to third parties — they are reported only to you under a responsible-disclosure policy, and never exploited. Scope and authorisation are confirmed in writing beforehand.
How an engagement works
| 1. Inquiry (free) | Email us the target you want researched and your concerns. We can sign an NDA. |
|---|---|
| 2. Scope & quote | We fix the target software, authorised scope, and timeline in writing, and provide a quote. |
| 3. Research | Within the agreed scope, we combine fuzzing, formal methods, and manual analysis to find unknown vulnerabilities. |
| 4. Report | Findings organized with severity (CVSS), plus reproduction steps and remediation guidance, reported only to you. |
| 5. Re-test (optional) | We can re-verify after your fixes. |
Beyond vulnerability research (consulting)
Beyond zero-day research, we also offer technical consulting across the areas below — from university mathematics and computer science to AI adoption and software development. From a one-off learning session to an ongoing technical-advisor role, quoted to scope. You can raise all of it through the same point of contact.
| University math & CS | From linear algebra, calculus, probability/statistics and discrete math to the algebra (groups, rings, fields) and number theory behind cryptography. Algorithms, computability, OS, networking, databases — the CS fundamentals. Student support and reskilling welcome. |
|---|---|
| AI adoption | Using LLMs to streamline work, help adopting generative AI, and building AI into development workflows. We honestly separate where AI has the edge from where human judgement is still needed, then work out how far it can go in practice. |
| Security assessment | Vulnerability assessment of web apps and networks, design/review of malware-detection rules such as YARA, and technical evaluation of security products. |
| System / software development | App development in Rust, TypeScript, Vue, etc., paying down technical debt, architecture design support — from MVP and prototyping to an ongoing technical-advisor role. |
Who does the work
The work is done by the solo developer who builds MIKAGE (Antivirus and NET). We won't pretend to be a team — which is precisely why your point of contact and the person doing the work are the same, and you can discuss the research approach and reasoning directly. The reasoning is public on the technical blog. For work that needs large-scale continuous monitoring or a big team, we'll tell you honestly whether we're the right fit.
- Formalizing vulnerabilities with mathematics — the basis (searching for ∃x ¬Safe)
- What is a CVE? Learning from famous vulnerabilities — known vs. unknown
- Finding and fixing our own YARA false positives — hands-on detection-logic experience
Start with a free inquiry.
Every engagement is quoted to its scope and content (guide range ¥500,000–¥3,000,000). We do not take online payment. From a focused spot study to deep supply-chain research, tell us what you have in mind.
Email us