0block was founded in 2020 in Waterloo, Ontario by a tight crew of operators who were tired of "penetration tests" that were really vulnerability scans with a logo on the cover. We had all sat through the same theatre — a tool runs, a template fills in, a PDF ships, and nothing an actual attacker would do ever gets tested. So we built the opposite: manual, chained, adversary-led engagements that prove real business impact and read like the work of people who actually break things.
We are offensive-only by design. We don't sell the defensive products we'd be grading, and we don't pad scopes with managed services — the entire firm exists to think like the attacker and write like the engineer. We planted that firm in Canada on purpose: Waterloo sits on one of the deepest security and systems-engineering talent pools in the world, and Canadian data-sovereignty law lets regulated clients keep sensitive testing artefacts under a single, predictable jurisdiction instead of scattered across borders.
Six years on, that single cell has grown into a Canadian firm of 7 full-time researchers holding 20+ offensive certifications, with offices in Waterloo, London, and Calgary, a hardware lab that tears down "unhackable" devices, and a cryptography practice that has reviewed protocols holding $1B+ in value. We've delivered 310+ engagements for 120+ clients, disclosed 10 zero-days with assigned CVEs, and reached objective in 100% of our red-team operations. Most importantly: zero client breaches post-remediation. That number is the whole point — and it is the mission we measure ourselves against.