Still here when the contract renews for the tenth time.
Kahu Labs is a security research lab. We build BuildSecure, and we spend the rest of our time breaking into things so the product knows what breaking in actually looks like.
Why we exist
Every company now runs on things connected to the internet. Each one is a door somebody can try. Most companies cannot tell you how many doors they have, let alone which are unlocked.
The industry answered that by selling more tools, more dashboards and more alerts. We think it runs the other way. Find everything, test it properly, prove what is broken, and say so in words the person paying for it can act on. That is the entire job, and it is harder than it sounds.
Who we work with
We are not the cheapest option and we have no intention of becoming it. Doing this properly takes time, judgement, and people who have actually broken into production systems. That costs money. Anyone telling you otherwise is selling volume and hoping nobody checks.
The organisations we do our best work with already understand that. They treat security as something worth doing well rather than a line item to survive an audit, and they want a partner who will be around long after the current one has moved on to something more fashionable. If price is the deciding factor we will say so on the first call rather than take six months of your year.
How we work.
Four standards we hold to, whatever the engagement is worth.
We prove it or we don't send it
Every issue arrives with what we did and what came back. If it cannot be reproduced, it does not reach you.
No stone unturned
We would rather run the check that finds nothing than skip it and hope. Thoroughness is the product.
Quiet about our clients
Findings are published only once they are fixed, with names and identifying detail removed.
Calm when it is bad
The worse the news, the plainer we say it. Nobody needs a security vendor raising their heart rate.
We say no
Work we cannot stand behind in ten years is work we turn down, however good the quarter looks.
We stay
Measured in decades rather than funding rounds. We would rather grow steadily with organisations that stay.
The long view
Security is the work. We are not passing through it on the way to something else, and we are not assembling a portfolio of adjacent products to sell later.
That decides what we take on, who we hire, and how we price. A company that intends to outlast its clients’ problems cannot afford one it failed, so we would rather turn down work than do it badly.
Kahu Labs trades as Shokunin Technology Inc., registered in Delaware, USA.
Judge the work, not the pitch.
A scoped review of one system you choose, and you can decide for yourself whether we are any good.
or write to hello@kahulabs.com