Company
Measurement over assumption
Veync builds the assurance layer for an enterprise that now runs on AI it cannot fully observe. Our European headquarters are in Paris La Défense.
The name
Why Veync
The Renaissance produced the first engineers who refused to accept a structure's strength on anybody's word.
Leonardo da Vinci is remembered as an artist, but he spent much of his working life as a military engineer. He designed fortifications and he designed the machines to breach them, and he saw no contradiction in that: you cannot know how strong a wall is until you have thought carefully about how you would bring it down.
He applied the same method to the human body. Where his contemporaries worked from inherited authority, he dissected, measured and drew what was actually there — and found that a great deal of what everyone knew was wrong. The Vitruvian Man, the figure inside our mark, is the emblem of that method: not a celebration of proportion but an act of measurement, testing a classical claim against a real body.
That is the discipline this company is named for. Enterprise security runs substantially on inherited authority: a control is effective because it is deployed, a policy is enforced because it is written, an agent is contained because it was configured that way. Veync exists to measure those claims instead of accepting them.
The method is old. What is new is that the measurement can now be continuous, because the adversary can be autonomous — and that AI has introduced a layer where almost nothing has been measured even once.
How we work
Four commitments
These are operating constraints rather than aspirations. Each one costs us something, which is how you can tell they are real.
Evidence over assertion
We do not publish a number we have not measured, including about ourselves. The figures on this site describe the platform as built; customer results are shared under NDA, with the method that produced them.
Authorization before capability
Offensive capability is only acceptable under written authorization with enforced limits. We turn down work we cannot scope properly, and the control plane is engineered so that decision is not left to an operator's judgement.
Restraint in what we publish
Control-evasion research is dual use. Specific results reach the affected party and the customer, never a public blog, and our own marketing does not name a product we have defeated.
Plain description of limits
We say what the platform does not do: it is not a certification, it does not replace a human adversary for novel work, and it cannot prove the absence of a vulnerability. A vendor that never states a limit is describing a brochure.
European headquarters
Paris La Défense
Europe's largest purpose-built business district, and the centre of gravity for the regulated institutions that carry the heaviest evidence burden under DORA and NIS2.
Office address
Tour First, 1 Place des Saisons, 92400 Courbevoie — Paris La Défense, FranceFloor 32
Operating from the EU is a product decision as much as a corporate one. Validation evidence is a detailed map of where a customer's defences fail, and for a European institution the residency and legal custody of that map is part of the buying decision.
Team
Founders
Veync was founded by two enterprise security practitioners. Their careers were spent inside the controls this platform now puts to the test.
Anwar Ul Haq
Founder
Eighteen years in enterprise security, centred on incident management and response at enterprise scale — the work of establishing, under pressure, whether a control actually held. Veync exists to answer that question before the incident, not during it.
Asad Ali Khan
Co-Founder
A network security specialist whose practice has been built inside large enterprise environments. He co-founded Veync to bring that view of how an enterprise network actually behaves to the way its defences are tested.
Responsible conduct
The constraints we accept
Veync builds autonomous offensive capability, and that obliges us to be explicit about how it is governed. We operate only under written authorization from an accountable owner, with scope, permitted techniques, escalation paths and stop conditions agreed before anything runs and enforced by the control plane rather than by an operator remembering them.
We will not take work we cannot scope properly, and we will not accept an engagement where the person authorizing it does not have the standing to do so. Both have commercial cost. Both are the price of the capability.
On research, our bias is towards the defender. A finding that affects a customer's control goes to that customer. A finding in a third party's product goes to that party under coordinated disclosure, with a reasonable window and an extension if the fix is genuinely hard. We do not publish material whose main function is to work as an attack against unpatched systems, and we do not use a disclosure as a route to a sales conversation.
We also do not claim to have defeated anybody's product. Describing a control category honestly is both more accurate and more useful than naming a vendor, and the version of this page that named names would be a legal problem rather than a credential.
Work with us, or come and build it
If the thesis above is one you recognise from your own environment, a validation briefing is the direct route. If you would rather build it, we are hiring.
veync.com is operated by VEYNC. Company details are on the legal notice page.