About
I'm Sevban Dönmez, a Senior Cyber Security Consultant at PwC focusing on offensive security, penetration testing, and vulnerability research.
Background
I am a Senior Cyber Security Consultant at PwC with 5+ years of corporate consulting experience and 14+ years of hands-on offensive security research. Over that time I have conducted more than 400 enterprise penetration tests and adversary simulations, and discovered over 100 zero-day vulnerabilities across critical infrastructure, enterprise software, and open-source ecosystems.
I hold the OSCP, CRTO, and CPTS, and ISO 27001, 27701, 42001, and 22301 Lead Auditor credentials.
What I work on
Most of my time goes to vulnerability research: finding the root cause of a bug, reading the vendor's fix, checking for variants, and reporting it through coordinated disclosure or a bug bounty program.
I also run red team engagements and penetration tests on web and mobile applications, iOS and Android internals, internal and external networks, Active Directory, cloud, and AI agents, and I write the tooling I need for them, including command-and-control infrastructure.
Open source & disclosures
I write open-source security tools, including a macOS hardening auditor, a covert C2 framework, an eBPF network sniffer, and a red-teaming harness for AI agents. They are all on the projects page.
I contribute to the OWASP Web Security Testing Guide, Cheat Sheet Series, and API Security Project, and to tools like Metasploit, Trivy, and Nuclei. The vulnerabilities I report are listed on the CVEs page.
About this site
jankesec is an ad-free archive of my security research, coordinated disclosures, and open-source projects. Everything published here focuses on root causes, reproducible attack paths, and practical engineering rather than scanner output or compliance checklists.