01
Offensive Security
Red teaming and adversary simulations that test people, processes, and technology against realistic attack paths.
- Red-team operations
- Adversary simulation
- Detection-focused debriefs
- Authorized malware and ransomware simulation
OFFENSIVE SECURITY · AI SYSTEMS · SWITZERLAND
Find the weakness. Build the resilience.
Safematix delivers hands-on offensive security, ethical hacking, AI security, and AI engineering for organizations that need evidence—not theatre.
Based in Wollerau, SwitzerlandWorldwide remote & on-siteBackground-check ready
01 / Services
Attack with intent. Build with evidence.
02
Ethical Hacking
Authorized, clearly scoped penetration testing that turns exploitable weaknesses into prioritized fixes.
- Web, API & infrastructure testing
- Cloud & configuration review
- Actionable reporting & retesting
03
AI Security
Attack the model, agent, and tool chain before someone else does. Find practical attack paths and help harden the controls around them.
- LLM & agent red teaming
- Prompt injection & MCP attack paths
- Containment, policy & audit controls
04
AI Services
Build local inference, RAG, and agent systems for high-security environments—from model training and tuning to production operations.
- Local high-security inference
- Voice recognition, LLM training & tuning
- RAG systems & agent enablement
05
Cyber Security Consulting
Strategy, architecture, governance, and resilience for regulated and high-security environments.
- ISMS, risk & compliance roadmaps
- Cloud, identity, OT & AI architecture
- Incident response, BCM & tabletop exercises
06
Secure Development Training
Two days of practical secure design, coding, review, and testing for engineering teams.
- Up to 25 participants per group
- Secure coding, threat modeling & code review
- Certification preparation and evidence
02 / PACKAGES
Clear packages. Senior delivery.
Fixed-scope starting points for security, regulated AI adoption, and measurable automation. Choose a package or bring a different scope.
For organizations of different sizes and industries. Robert brings experience from pharma, banking, insurance, telecom, industry, OT, and nuclear power plants.
START WITH CLARITY
Security & AI Orientation
CHF 3’900
2 working days
Prioritize security risks and AI opportunities before committing to a larger assessment or build.
- One system or AI-use-case review
- Risk, regulatory, and automation priority map
- 90-minute findings and next-steps session
Not included
- Production testing or implementation
- Formal compliance certification or legal opinion
- Additional systems or workshops
AUTHORIZED TESTING
Web & API Security Assessment
CHF 9’800
5 working days
Find exploitable weaknesses in one web application and turn them into prioritized, reproducible remediation.
- One web application with its API and up to two roles
- Manual testing, evidence, and prioritized report
- Debrief and one focused retest within 30 days of the initial debrief, using the client-supplied remediated build or configuration
Not included
- Load, stress, or destructive testing unless expressly authorized
- Remediation development or additional targets and roles
- More than one focused retest
AGENT & TOOL-CHAIN DEFENSE
AI Agent & MCP Security Assessment
CHF 14’800
8 working days
Attack one agent and its tool chain, then help harden the controls that contain real attack paths.
- One AI agent with up to five MCP tools or integrations
- Prompt injection, data exfiltration, privilege, and containment testing
- Evidence report, remediation workshop, and one focused retest within 30 days of the initial debrief, using the client-supplied remediated build or configuration
Not included
- Additional agents, tools, or production model training
- Formal compliance certification or legal opinion
- More than one focused retest
AUTOMATION WITH CONTROL
Secure AI Agent Value Sprint
CHF 24’800
12 working days
Turn one costly workflow into a secure, evaluated agent pilot—with controls and measurable operating assumptions, not automation theatre.
- Baseline, target architecture, and compliance-control mapping for one workflow
- Agent pilot with up to three integrations, evaluations, and audit controls
- Handover, operating guide, and prioritized next steps with success measures
Not included
- Additional workflows, integrations, or production features
- Third-party licenses, hardware, and cloud consumption
- Ongoing operations after handover unless separately agreed
Flexible engagements: CHF 2’200 per working day. Longer, clearly scoped remote projects: CHF 2’000–2’100. Short-notice OT, red-team, and high-security engagements: CHF 2’400–2’600, subject to scope.
All package prices and day rates exclude applicable VAT and pre-approved travel and third-party costs, unless expressly included in the order form. Fixed-price packages apply within their stated scope. Scope, authorization, and start date are confirmed in writing before work begins. Regulatory mapping is technical, not legal advice. Savings and compliance outcomes are not guaranteed.
03 / Approach
Senior hands-on work, from scope to hardening.
A clear process before, during, and after the technical work. You always know what is in scope, what happens next, and which artifact you receive. Phases and deliverables depend on the selected package and written scope. Assessments recommend and verify client fixes; hands-on remediation or pilot implementation is included only when expressly scoped.
- 01
Scope
Clarify objectives, systems, data classification, constraints, and the result your team needs. A short confidential scoping call becomes a written target list, success criteria, and fixed or separately agreed scope. The price basis is agreed separately.
Deliverables- Written scope and target inventory
- Success criteria and fixed-price or day-rate basis
Your responsibility Name a technical contact and describe the business objective. No secrets or sensitive exploit details in the first enquiry.
- 02
Authorize
Before testing, the system owner approves targets, roles, timing, evidence handling, and stop conditions. Communication, access, and escalation paths are agreed explicitly.
Deliverables- Rules of engagement and authorization
- Access plan, secure communication, and escalation contacts
Your responsibility Confirm ownership and provide agreed accounts, roles, and environment access.
- 03
Execute
Test manually, research, or build hands-on. Work is limited to the agreed scope, with short checkpoints and no black-box handoff. AI-assisted work is verified by Robert before it becomes evidence.
Deliverables- Reproducible evidence log or working prototype
- Checkpoint notes and immediate critical findings
Your responsibility Answer technical questions and flag operational constraints early.
- 04
Explain
Findings and design decisions are explained in business and technical terms. Each item includes preconditions, reproducible evidence, impact, root cause, and a prioritized fix—without inflated severity.
Deliverables- Technical evidence and executive summary
- Prioritized remediation backlog and debrief
Your responsibility Bring the people who can assess impact and implement fixes.
- 05
Harden
Review remediation and control changes together, then repeat the relevant test or evaluation. Results distinguish fixed, partially fixed, and open items, including residual risk.
Deliverables- Focused retest result
- Updated controls and remaining actions
Your responsibility Apply agreed fixes and provide the updated build or configuration for verification.
- 06
Handover
Finish with an operating guide, knowledge transfer, and next-step decisions. Engagement material is handled through the agreed secure process; ongoing support is a separate, explicit scope.
Deliverables- Report, operating guidance, and handover session
- Owner-ready next steps and optional follow-up scope
Your responsibility Confirm owners for remaining actions and operating responsibilities.
One direct technical contact throughout. No black box, no junior handoff, and no sensitive details in the initial form.
04 / PROOF
Proof, not theatre.
- years in systems
- 20+
- penetration testing and red-team projects
- 150+
- countries with embedded delivery
- 11
- listed credentials
- 39
Critical vulnerability research
Public disclosure of a critical WordPress Core vulnerability, grounded in reproducible technical research.
AI-security tooling
MCP runtime policy and audit controls with mcp-firewall, plus pre-deployment scanning with mcpwn.
Model engineering in public
Published work on model behavior, quantization, and deployable formats.
05 / About
Robert Ressl
Swiss at heart. Global by delivery.
Safematix is founded and led by Robert Ressl, a Swiss security and AI systems engineer. His work spans Linux and cloud platforms, global offensive-security delivery, model engineering, and regulated production. You work directly with the person doing the technical work.
Available for deep background checks and work in high-security environments.
Remote worldwide. Travel for on-site engagements by arrangement.
06 / FAQ
Before we start.
Where is Safematix based?
In Wollerau, Schwyz, Switzerland, with delivery worldwide.
Can we work remotely or on-site?
Both. Remote delivery is available worldwide, with travel for on-site needs by arrangement.
Are you open to deep background checks?
Yes, and I can work in high-security environments.
Do you cover both traditional and AI security?
Yes. Safematix combines offensive security and ethical hacking with model, agent, MCP, and inference expertise.
What happens after an enquiry?
You receive a direct reply to arrange a confidential scoping conversation. Do not send secrets or sensitive exploit details through the initial form.
07 / Contact
Bring the difficult problem.
Tell me what you need to test, secure, or build. No sensitive details at this stage.