Open navigation

DARK HORIZON LABS

Dark Horizon Labs: cybersecurity company in London

Penetration testing, threat intelligence and incident response.

Explore our capabilities Talk to an expert

01.About

Every breach begins beyond the horizon: in the systems no one mapped, the access no one revoked, the threat no one has named yet. That is where we work.

Frontier cybersecurity for a more resilient tomorrow.

Dark Horizon Labs is a London cybersecurity company working across research, intelligence and resilience: penetration testing and red teaming, threat intelligence and detection, incident response and digital forensics. We find the weaknesses an attacker would find, close them before they matter, and tell you plainly what we saw.

Our work starts where your visibility ends: forgotten infrastructure, inherited permissions, suppliers with a key to the building.

02.Capabilities

Cybersecurity across the full attack lifecycle.

Five disciplines, one team. Open any of them to see who it suits, what you receive and the services inside.

Find the route before an attacker does.

Authorised, adversary-grade testing that shows exactly how your organisation could be breached, and how to stop it.

Best suited to
Teams launching new products or infrastructure, preparing for an audit or due diligence, or wanting an honest answer to “how would someone get in?”

What you receive

  • Executive summary for leadership
  • Technical report with evidence, risk ratings and fixes
  • Attack-path narrative for the critical routes
  • Debrief with the testers, then a retest of your fixes

Services

  • Network penetration testing
  • Web application penetration testing
  • Cloud infrastructure penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • ICS, OT and IoT penetration testing
  • AI and LLM penetration testing
  • Red teaming and adversary emulation
  • Exploit development

Enquire about offensive security

See the threat before it reaches you.

Intelligence-led security operations that turn noise into signal and catch attackers early in the kill chain.

Best suited to
Security teams drowning in alerts, SOCs that need sharper detection, and leaders who need to know which threats actually target their sector.

What you receive

  • Threat landscape briefing tailored to your sector
  • Detection rules mapped to MITRE ATT&CK
  • Hunt reports with findings and next actions
  • Coverage gaps ranked by attacker likelihood

Services

  • Cyber threat intelligence
  • Threat hunting
  • Open-source intelligence (OSINT)
  • Detection engineering
  • Security operations (SOC)
  • Cloud security operations

Enquire about threat intelligence

Contain, investigate, recover.

Digital forensics and incident response (DFIR) when it matters most: we establish what happened, stop the spread and get you back on your feet.

Best suited to
Organisations facing an active or suspected incident, and those who want a tested response plan before they need one.

What you receive

  • Containment guidance from the first call
  • Forensic timeline of what happened, and how
  • Root-cause report for insurers, regulators and the board
  • Hardening plan so it does not happen twice

Services

  • Incident response and handling
  • Digital forensics
  • Cloud forensics and incident response
  • ICS and OT incident response
  • Malware analysis
  • Reverse engineering

Get incident response help

Build resilience into everything you ship.

Secure by design across code, cloud and infrastructure, so vulnerabilities are closed before they reach production.

Best suited to
Product and engineering teams shipping software, moving to the cloud or scaling fast without a dedicated security function.

What you receive

  • Findings delivered into your engineers’ own tools
  • Secure-by-default patterns and guardrails
  • Security checks wired into CI/CD
  • Pairing sessions with your developers

Services

  • Application security
  • Secure code review
  • DevSecOps
  • Cloud security engineering
  • Network and endpoint security
  • Vulnerability assessment
  • Cryptography review
  • Hardware security

Enquire about security engineering

Turn security into a board-level advantage.

Clear, practical information security consultancy that connects technical risk to business decisions.

Best suited to
Boards, CISOs and founders who need to show regulators, customers or investors that cyber risk is understood and under control.

What you receive

  • Gap analysis against your chosen framework
  • Risk register with owners and priorities
  • A realistic, costed improvement roadmap
  • Board-ready reporting in plain language

Services

  • Information security consultancy
  • Cyber risk assessment
  • Security strategy and CISO advisory
  • Compliance readiness: ISO 27001, Cyber Essentials, NIST CSF, NIS2, DORA

Enquire about GRC

03.How we work

What an engagement actually looks like.

Every engagement follows the same five steps, so you always know where you stand, who you are talking to and what you will hold at the end.

  1. 01

    Scope

    A call with the people who will do the work. We agree goals, targets, rules of engagement and timings.

    You getA written scope, test plan and fixed quote.

  2. 02

    Test

    Manual-led testing by specialists, with a named contact throughout. Anything critical is raised immediately, not saved for the report.

    You getLive updates and critical-finding alerts.

  3. 03

    Brief

    Findings ranked by real business risk, written for two audiences: leadership and the engineers who will fix them.

    You getExecutive summary, technical report and a debrief call.

  4. 04

    Remediate

    We stay on hand while you fix things: clarifying findings, reviewing proposed changes and helping you prioritise.

    You getRemediation guidance and engineer support.

  5. 05

    Retest

    We verify every fix against the original finding, so closed means closed.

    You getA retest report you can share with customers and auditors.

Common questions

What is penetration testing?

Penetration testing is an authorised, simulated attack on your systems to find exploitable vulnerabilities before a real attacker does. Dark Horizon Labs tests networks, web applications, cloud infrastructure, mobile apps, wireless networks, ICS, OT and IoT environments, and AI systems, then delivers prioritised findings with clear remediation.

How is red teaming different from penetration testing?

A penetration test aims to find as many vulnerabilities as possible within a defined scope. A red team engagement emulates a real adversary end to end, often covertly, to test how well your people, processes and detection hold up against a determined attacker.

What should we do if we have been breached?

Contain first, then investigate. Preserve evidence, avoid wiping affected systems, and bring in incident response and digital forensics specialists early. Dark Horizon Labs helps organisations contain incidents, establish what happened, and recover with stronger defences.

Where is Dark Horizon Labs based?

Dark Horizon Labs is a cybersecurity company based in London, United Kingdom.

04.Evidence

The work, shown rather than claimed.

Client work stays confidential, so we share it anonymised and with permission. This is the shape of what we find and how we report it.

Case file 01Sector Financial servicesEngagement Red team

From a forgotten staging server to customer payment data, without a single phishing email.

The brief
A London payments company wanted to know whether an external attacker with no inside knowledge could reach customer card data.
The route in
An unlisted staging subdomain exposed a build artefact containing a cloud access key. That key reached a storage bucket holding database snapshots, and the snapshots held credentials for the production payment service.
The outcome
The critical path was reported on day two and closed within the week. Detection rules were added for each technique used, and a retest confirmed the route was gone.
Example content: replace with a real, client-approved engagement
Report · Finding 03 of 17Confidential

Cloud access key exposed in public build artefact

CriticalCVSS 9.1MITRE T1552.001

Affected asset

staging-.example-client.com

Evidence

$ curl -s https://staging-/static/app..js | grep -o 'AKIA[A-Z0-9]*'
AKIA
$ aws s3 ls --profile exposed
  db-snapshots-

Business impact

Anyone on the internet could read nightly database snapshots, including credentials for the production payment service.

Remediation

Revoke the key now. Move build secrets to a managed vault, add secret scanning to CI, and restrict the bucket to the backup role only.

Sample report · fictional client, real format Request the full sample

05.From the lab

Research that sharpens every engagement.

The Labs in our name is literal. We study how real intrusions unfold and feed it straight back into how we test, detect and respond.

Anatomy of a modern breach

Attack path · where each step can be broken

  1. 01 · Recon

    Staff and exposed services mapped from public sources

    T1593

    Breaks hereAttack-surface monitoring

  2. 02 · Access

    MFA fatigue: push requests until someone taps approve

    T1621

    Breaks herePhishing-resistant MFA

  3. 03 · Foothold

    Session cookie stolen from the browser and replayed

    T1539

    Breaks hereDevice-bound sessions

  4. 04 · Escalate

    An over-permissioned cloud role becomes admin

    T1078.004

    Breaks hereLeast-privilege review

  5. 05 · Move

    Reused service credentials open the next system

    T1021

    Breaks hereSecret rotation and segmentation

  6. 06 · Impact

    Data quietly copied out to attacker-controlled storage

    T1567

    Breaks hereEgress monitoring

From the press room

All stories
  • Identity security

    ASOS breach puts trusted customer channels under scrutiny

    An unauthorised app notification and a stolen employee login highlight the reach of third-party customer platforms.

    Read
  • Operational resilience

    Ahold Delhaize begins controlled recovery after taking systems offline

    The retailer says stores remain open across Europe and the US while it investigates a network security incident.

    Read
  • Operational technology

    French refrigeration attacks expose the physical cost of remote access

    CERT-FR warns of compromised refrigeration controllers and urges operators to remove direct internet exposure.

    Read

06.Our focus

The driving force behind a safer tomorrow.

  1. 01

    Research

    Deeper understanding for a complex world.

    We study how attacks really unfold, across your systems, your suppliers and the parts of your estate that fell off the inventory years ago.

  2. 02

    Intelligence

    Clearer insights for stronger decisions.

    We turn what we find into plain, prioritised findings, ranked by what actually puts your organisation at risk.

  3. 03

    Resilience

    Built today for a brighter tomorrow.

    We help you close the gaps and stay ready, so the next threat meets an organisation that has already prepared for it.

07.Contact

Security beyond tomorrow.

Tell us about your organisation. We will tell you, honestly, where we would look first.

hello@darkhorizonlabs.com

Dealing with an incident right now? Choose “Incident response (urgent)” in the form, or email with URGENT in the subject line, and it goes straight to a responder.

Send an enquiry

We only use these details to reply to your enquiry. NDA available before any detail is shared.