EresusSecurity

Make CI/CD, Kubernetes, and release operations safer and faster.

Eresus provides delivery-focused DevOps support across Docker, Kubernetes, infrastructure as code, observability, release automation, and operational standardization.

Book a security briefingAll services

Vulnerabilities our researchers found and disclosed

Public advisories credited to the Eresus research team. The same people run your engagement.

All advisories

This engagement creates value fastest for teams like these.

Teams shipping under delivery pressure

Engineering organizations that need backend, mobile, DevOps, or DevSecOps support without losing security rigor.

CTOs and platform leads

Leads that need architecture, release, and operations support tied back to offensive validation priorities.

Programs that want build plus hardening

Buyers that do not want a separate delivery vendor and a separate security vendor working against each other.

Platform & scope

Docker, container-image, and registry workflows
Kubernetes, Helm, and rollout strategies
CI/CD, artifact, environment, and release processes
Observability, logging, alerting, and operational visibility

Improvement areas

Delivery and automation bottlenecks
Weak deploy, rollback, and environment standards
Operational visibility and alerting gaps
Scalability, resilience, and maintenance-cost concerns

Outcomes

DevOps architecture plan
CI/CD and release improvement recommendations
Operational observability checklist
Team handover and implementation notes

Evidence standard

Proof you can inspect. Boundaries you can plan around.

Every engagement is bounded by written authorization, evidence handling, and a clear handoff. These are the defaults; the signed scope can tighten them.

Evidence you receive

  • Architecture, code, or configuration decisions tied to the agreed scope.
  • Reviewable changes, operational notes, and handoff documentation.
  • Security tradeoffs, release risks, and hardening priorities made explicit.
  • Verification steps for the delivered work.

Explicit exclusions

  • A penetration test report unless testing is separately scoped.
  • Production changes without an approved change window and rollback path.
  • Compliance certification or ongoing 24/7 support unless contracted.
  • Ownership transfer of third-party or pre-existing intellectual property.

A DevOps motion that simplifies operations and improves delivery speed.

01

Infrastructure and delivery baseline

We make cluster, container, environment, pipeline, and release bottlenecks visible together.

02

Standardization and automation

We shape CI/CD, IaC, rollout, and operational automation so recurring delivery work becomes predictable.

03

Observability and handover

We ship logging, metrics, alerting, and operating notes that the internal team can sustain.

The questions buyers want answered early.

How does this relate to pentest work?+
We keep offensive validation primary. Delivery support exists to help teams fix, ship, and operate the systems that pentest work puts under pressure.
Do you work inside an existing engineering roadmap?+
Yes. We can work inside an existing roadmap, sprint cadence, and release model while making security tradeoffs explicit.
What do teams get besides code or configuration?+
Teams receive architecture direction, operational notes, release guidance, hardening priorities, and handoff documentation.

We improve delivery speed together with operational quality.

The goal is not just more automation; it is a more reliable, repeatable release motion. Every improvement should reduce operational friction for the team.

DevOps output is not just a pipeline, it is an operating standard.

Pipeline, environment, rollout, observability, and handover guidance are treated as one system so the team leaves with a sustainable delivery standard.

Research and advisories that support this service motion.

Research

How to Build Fully Autonomous and Secure CI/CD Pipelines

Discover the DevSecOps secrets and strategies for building autonomous, highly observable, and inherently secure CI/CD pipelines for modern engineering...

Research

GitOps Security in ArgoCD Architecture: How to Protect Your K8s Clusters

ArgoCD and GitOps architectures rely on a Single Source of Truth. Learn how attackers exploit supply chain vulnerabilities and the detailed guidelines...

Research

Kubernetes (K8s) Penetration Testing Playbook: The Black Box Approach

How do cyber attackers breach your Kubernetes (K8s) clusters from the outside without prior knowledge? An in-depth look into Black Box Kubernetes...

Advisory

ERESUS-ADV-2026-002: Server-Side Request Forgery (SSRF) via Cloud Metadata Endpoints

Server-side request forgery in cloud-hosted URL fetch flows can expose metadata services, temporary IAM credentials, and internal configuration.

Advisory

n8n-mcp Authenticated SSRF: CVE-2026-39974 (GHSA-4ggg-h7ph-26qr)

CVE-2026-39974 is an authenticated SSRF in n8n-mcp multi-tenant HTTP deployments. Review affected versions, the 2.47.4 fix, and layered mitigations.

Let’s scope this work against the surface that matters most.

Whether this starts as a pilot, a single application, a critical API, an AI agent flow, or a wider program, we start from the highest-impact surface.

Book a security briefingRequest a scope review