We find what was never specified.
API and AI security testing. The work that scanners can't do. Twenty years of specification-led testing applied to the security of your systems.
Software fails in the behaviour that was never specified. What happens at midnight. What happens when the request is sent twice. Automated scanners catch the obvious, known CVEs, missing headers, default credentials, but the flaws that matter have no signature. They can't be pattern-matched.
An unspecified behaviour is an untested behaviour. An untested behaviour is an attack surface.
Reading the gap between what was intended and what was built is Testclub's entire discipline. We've spent twenty years finding what falls through it, first as bugs, now as vulnerabilities and AI failures.
Testclub was founded in 2012 by Omar El Dali, built on twenty years at the boundary between specification and implementation, across trading platforms, fintech, insurance, health, energy and government.
The difference is structural, not stylistic. A senior collective, not an agency: no junior staff, no learning on the job. The people you meet do the work. Every finding arrives with its evidence and the method that produced it, so a sceptical engineer can follow every step.
Meet the founder →
Testclub's approach was flexible and amenable to our needs and they ensured that every effort was put in to make the project a success. There are many turn-key testing services out there, however Testclub's ethos and knowledge applied a personal touch that really made the difference. Totally recommend Testclub and would use them again.
There are many turn-key testing services out there, however Testclub's ethos and knowledge applied a personal touch that really made the difference. Totally recommend Testclub and would use them again.