onurcangenc.com.tr

What it is

onurcangenc.com.tr is the personal homepage of Onurcan Genç, an individual security researcher, rather than the official website of a standardized cybersecurity product. He positions himself as an Offensive Security & AI Red Team Researcher based in Ankara, Turkey, and is open to international opportunities. The page highlights expertise in adversarial LLM attacks, prompt injection, web application security, and vulnerability discovery, and publicly lists credentials and achievements including 5 MITRE CVEs, 90+ technical articles, Deloitte CyberOps experience, and a TryHackMe Top 2% ranking.

Core capabilities and evaluation dimensions

In terms of protection type, the site leans more toward offensive security and validation-oriented security services, including web/mobile/wireless/LAN penetration testing, AI/ML red teaming, CVE research, and dark web credential leak verification. AI security is its key differentiator: the PromptShot project involves multi-stage LLM red teaming, jailbreak generation, system prompt pollution, and role hijacking. NucAIScan and web_app_ai_scanner demonstrate a combination of automated reconnaissance, DAST, Nuclei, FFUF, and GPT-4-based template selection. The deployment model is not presented as SaaS or enterprise software, but rather as multiple Python/GitHub projects and customizable toolchains, with some components involving Elasticsearch, Telegram Bot, GitHub Actions, Docker, OpenAI API, and related technologies.

Pricing, compliance, and support

The text provides no pricing, plans, payment methods, contract terms, or SLA details, so procurement costs cannot be evaluated in the same way as for a mature vendor. On the compliance side, the page discloses personal qualifications such as eWPTXv3, eWPT, Security+, CAP, CNSP, AWS Cloud Quest, Cisco CCNAv7, and others. It also references frameworks used in his work, including MITRE ATT&CK, CVSS, OWASP Top 10, and PTES. However, it does not provide company-level ISO, SOC 2, data protection, or customer compliance evidence. Management and alerting capabilities are mainly reflected in LeakCTL’s Telegram integration and Elasticsearch backend, as well as automated report generation in scanning tools. A unified console or enterprise-grade alerting closed loop is not yet evident.

Pros, cons, and who it is for

The strengths are a transparent technical track record, a focused research direction, and public CVEs and tool-building experience at the intersection of LLM security and Web AppSec. It is suitable for teams that need expert-led AI red teaming, prompt injection assessment, web penetration testing, vulnerability research, or prototypes for automated security tools. The limitations are also clear: this is a personal homepage, with no disclosed delivery process, service support model, team size, legal contracts, or commercial guarantees. It is therefore not suitable as a direct replacement for a large MSSP or a compliance-oriented managed security service.

Access from China and alternatives

Access from mainland China cannot be determined from the page content alone, so it should be marked as unknown. Payment methods are also not disclosed, and cross-border cooperation may require email communication. If localized procurement, Chinese-language delivery, MLPS-related support, or compliance add-ons are required, domestic vendors such as Qi An Xin, NSFOCUS, DBAPPSecurity, Chaitin Tech, and Knownsec may be worth considering. If the priority is LLM red teaming and research-driven offensive/defensive work, this researcher is better suited as a candidate for specialized consulting.