Offensive security
Application, network and cloud testing. This team writes the technical reports and runs the lab environments used in our hacking courses.
Named after a lock. Built around the people who hold the keys.
Qufl (قفل) means lock. It is a small word for a big idea: most of what protects an organisation is not a product you buy, it is the habits of the people who work there.
Why we exist
Security advice in Pakistan has a delivery problem. Organisations in Peshawar are often sold international playbooks, written for a bank in another hemisphere, by people who have never seen their network. The report arrives, the recommendations do not fit, and nothing changes.
We started Qufl Tech to close that gap. Same technical rigour, different delivery: testing that accounts for the systems you actually run, and training that assumes your team is busy and your budget is real.
What we believe
Three positions shape every engagement.
- Findings must be actionable. A critical finding with no reproduction steps is theatre. Every issue we report has an owner, a fix, and a way to verify it.
- Training is retention work. A phishing poster changes nothing. A person who has watched an attack fail because of a decision they made will remember it for years.
- Honesty is a security control. We tell clients what we cannot do, and we do not claim certifications, partnerships or accreditations we do not hold.
Rooted in Khyber Pakhtunkhwa
Our clients are here. Our instructors are here. That matters practically: we can be onsite in Peshawar the same week, we understand the regulatory and procurement context, and we can deliver training in English or Urdu depending on the room.
It also matters for talent. KP produces capable graduates who leave for lack of local entry-level security roles. Our training is designed to change that arithmetic — practical, lab-based, and connected to the work we do for clients.
How we are organised
Small enough that the person who scopes your work is the person who does it.
Defensive operations
Detection engineering, log pipelines and analyst work for organisations under monitoring retainer. They run the SOC Analyst course.
Governance & training
ISO 27001 and SOC 2 readiness, policy design, and the curriculum for our GRC and awareness programmes.
Named instructor profiles and credentials are published per course on the training page once confirmed for each cohort.
What we will not do
Clear boundaries make for better engagements.
Claim credentials we lack
We are not an authorised partner of any certification vendor, and we are not ISO certified as a company. If that changes, it will be stated with the certificate number, not a badge graphic.
Test without authorisation
No active testing begins without written authorisation from someone entitled to give it. This protects you as much as it protects us.
Drown you in findings
A 90-page report with 300 findings is a way of avoiding the hard judgement about which three matter. We rank by exploitability and business impact, and say what to fix first.
Publish your data
Client work stays confidential. We do not publish case studies, names or screenshots without written permission, and we do not put client data in marketing decks.
Talk to someone who will do the work
No account managers, no discovery call theatre. One conversation with a practitioner, and an honest answer about whether we are the right fit.