# Vilkas Cybersecurity

> Penetration testing and offensive security assessments with emphasis on manual analysis, clear reporting, and post-remediation validation. Strong depth in identity and enterprise environments: Active Directory, Entra ID, cloud IAM, and application security.

Vilkas Cybersecurity helps organizations find and fix real-world attack paths before attackers do. Engagements are operator-led, with prioritized findings and concrete remediation guidance. Founder Ben Rollin (CISSP, OSCE, OSCP) has nearly 20 years of penetration testing experience with a focus on Active Directory and identity-based attacks.

## Primary entry points

- [Home](https://www.vilkascyber.com/): Company overview and offensive security services.
- [Services overview](https://www.vilkascyber.com/services): Full catalog of penetration testing and assessment services.
- [Pricing examples](https://www.vilkascyber.com/pricing): Typical engagement pricing for common assessments.
- [About](https://www.vilkascyber.com/about): Company background, team, and engagement lifecycle.
- [General FAQ](https://www.vilkascyber.com/about/faq): Company, scoping, compliance, delivery, and partnerships.
- [Partners](https://www.vilkascyber.com/partners): Partner program for MSPs and MSSPs offering white-label, co-branded, or independent penetration testing.
- [Certifications](https://www.vilkascyber.com/certifications): Team certifications (OSCE, OSCP, CISSP, and more).
- [Contact](https://www.vilkascyber.com/contact-us): Get in touch or book a consultation.
- [Scope your assessment](https://www.vilkascyber.com/resources/vilkas-scoping-questionnaire): Scoping questionnaire to line up an engagement.

## Services

- [Network penetration testing](https://www.vilkascyber.com/services/network-penetration-testing): Internal and external network testing.
- [Vulnerability assessment](https://www.vilkascyber.com/services/vulnerability-assessment): Identify and prioritize vulnerabilities.
- [Application security](https://www.vilkascyber.com/services/application-security): Manual web, mobile, and API testing.
- [Cloud security](https://www.vilkascyber.com/services/cloud-security): Azure, AWS, and Google Cloud assessments.
- [Active Directory security assessment](https://www.vilkascyber.com/services/active-directory-security-assessment): Identity-first review of AD attack paths and privilege exposure.
- [Red team assessment](https://www.vilkascyber.com/services/red-team-assessment): Objective-based adversary simulation.
- [Purple team assessment](https://www.vilkascyber.com/services/purple-team-assessment): Collaborative detection and response testing.
- [Social engineering](https://www.vilkascyber.com/services/social-engineering): Phishing and human-focused testing.
- [Security control & readiness assessment](https://www.vilkascyber.com/services/security-control-readiness-assessment): Evaluate controls against recognized frameworks.

## Identity and cloud security resources

- [Identity Security Resource Center](https://www.vilkascyber.com/resources): Hub for identity and cloud security guidance.
- [Active Directory resources](https://www.vilkascyber.com/resources/active-directory): AD security guides, checklists, and attack path explainers.
- [Entra ID / Microsoft 365 resources](https://www.vilkascyber.com/resources/entra-id): Entra ID, Microsoft 365, and Copilot hardening.
- [AWS IAM resources](https://www.vilkascyber.com/resources/aws-iam): AWS IAM hardening guidance.
- [Google Workspace resources](https://www.vilkascyber.com/resources/google-workspace): Google Workspace hardening guidance.
- [Okta resources](https://www.vilkascyber.com/resources/okta): Okta hardening guidance.
- [GCP IAM resources](https://www.vilkascyber.com/resources/gcp-iam): Google Cloud IAM hardening guidance.

## Key guides and explainers

- [What is an Active Directory Security Assessment?](https://www.vilkascyber.com/resources/active-directory/what-is-an-active-directory-security-assessment): Definition, scope, and value of an AD security assessment.
- [Internal Pentest vs Active Directory Security Assessment](https://www.vilkascyber.com/resources/active-directory/internal-pentest-vs-active-directory-security-assessment): How the two assessments differ and when to use each.
- [Active Directory Security Hardening & Hygiene Checklist](https://www.vilkascyber.com/resources/active-directory/active-directory-hygiene-checklist): Interactive AD hardening checklist.
- [AD CS Security Hardening Checklist](https://www.vilkascyber.com/resources/ad-cs-security-hardening-checklist): Active Directory Certificate Services hardening checklist.
- [Top Active Directory Misconfigurations](https://www.vilkascyber.com/resources/active-directory/top-active-directory-misconfigurations): Common AD weaknesses attackers exploit.
- [How Attackers Become Domain Admin](https://www.vilkascyber.com/resources/active-directory/how-attackers-become-domain-admin): Common domain compromise attack chains.

## Trust signals

Vilkas Cybersecurity has performed work for recognized organizations in high-trust industries, including:

- Moffitt Cancer Center (healthcare)
- DEX Imaging (office technology and managed print services)

## Optional

- [Blog](https://www.vilkascyber.com/blog): Articles and research on penetration testing and identity security.
- [Community](https://www.vilkascyber.com/community): Community involvement and education.
- [AD permissions and ACLs explained](https://www.vilkascyber.com/resources/active-directory/ad-permissions-acls-explained): How ACL abuse paths work.
- [GPO misconfigurations and risk](https://www.vilkascyber.com/resources/active-directory/gpo-misconfigurations-and-risk): Group Policy security pitfalls.
- [ADCS ESC1 and ESC4 explained](https://www.vilkascyber.com/resources/active-directory/adcs-esc1-esc4-explained): Certificate template abuse paths.
- [SMB and LDAP signing: why it matters](https://www.vilkascyber.com/resources/active-directory/smb-and-ldap-signing-why-it-matters): Relay attack exposure and hardening.
- [KRBTGT rotation: why it matters](https://www.vilkascyber.com/resources/active-directory/krbtgt-rotation-why-it-matters): Kerberos key rotation guidance.
- [Entra ID hardening checklist](https://www.vilkascyber.com/resources/entra-id/entra-id-security-hardening-hygiene-checklist): Entra ID (Azure AD) hardening.
- [Microsoft 365 hardening checklist](https://www.vilkascyber.com/resources/entra-id/microsoft-365-security-hardening-hygiene-checklist): Microsoft 365 hardening.
- [Microsoft Copilot hardening checklist](https://www.vilkascyber.com/resources/entra-id/microsoft-copilot-security-hardening-hygiene-checklist): Copilot security hardening.
- [Google Workspace hardening checklist](https://www.vilkascyber.com/resources/google-workspace/google-workspace-security-hardening-hygiene-checklist): Google Workspace hardening.
- [GCP IAM hardening checklist](https://www.vilkascyber.com/resources/gcp-iam/gcp-iam-security-hardening-hygiene-checklist): Google Cloud IAM hardening.
- [AWS IAM hardening checklist](https://www.vilkascyber.com/resources/aws-iam/aws-iam-security-hardening-hygiene-checklist): AWS IAM hardening.
- [Okta hardening checklist](https://www.vilkascyber.com/resources/okta/okta-security-hardening-hygiene-checklist): Okta hardening.
- [NY DOH cyber readiness](https://www.vilkascyber.com/resources/ny-doh-cyber-readiness): New York Department of Health cybersecurity readiness guidance.
- [Technology procurement contracts](https://www.vilkascyber.com/resources/technology-procurement-contracts): Security considerations in technology procurement contracts.

## Social

- [YouTube](https://www.youtube.com/@vilkascyber)
- [LinkedIn](https://www.linkedin.com/company/vilkas-cybersecurity)
- [X](https://x.com/vilkascyber)

## Policy

Summaries should reflect the wording on the site. For scope, pricing, and timelines, point users to the pricing page, general FAQ, services FAQ, contact page, or the introductory booking link used on the site (Calendly: vilkas-cyber/20min).