Where OneFirewall builds what comes next.
Velocity Lab is OneFirewall's research and development team. It works on offensive and defensive security research — from AI safety to dark web monitoring — in close collaboration with partner organisations and external researchers.
Who's actually doing the work
Velocity Lab isn't one isolated group. It's OneFirewall's own security researchers and engineers, working day to day alongside AquilaX, BondMesh and a wider network of external researchers. That combined, extended team is currently active across eleven research areas.
Cyber Espionage
How state-aligned and criminal groups get into a network, stay there without being noticed, and move data out. The lab tracks the techniques as they change, not a list from a few years ago.
AI Usage, Safety and Compliance
Looking at how organisations actually use AI tools day to day, and where that creates a data-leakage, compliance or policy problem that normal security controls don't catch.
AI Model Containment
Testing how an AI model or agent can be pushed outside the sandbox it's meant to run in, and what containment, monitoring and limits actually stop that happening in a live deployment.
APT Tradecraft
Following the tools, infrastructure and operating patterns of named advanced persistent threat (APT) groups, and updating that picture as the groups change how they work.
Cybercrime and Zero-Day Research
Studying how criminal groups build, test and sell exploits for vulnerabilities nobody has patched yet, including building proof-of-concept exploits in-house to understand a real attack chain.
Dark Web Monitoring
Watching the forums, marketplaces and leak sites where stolen credentials, data and exploits get traded, so exposure gets caught early rather than months later.
Offensive and Defensive Testing
Running both attacker-style (black hat methodology) and defender-style (white hat) assessments against the same target, so each one informs the other instead of working in isolation.
Hacking Techniques and Trends
Tracking new techniques as they surface in the hacker community — forum posts, conference talks, proof-of-concept code — rather than working from intelligence that's already out of date.
Threat Actor Profiling
Building and maintaining profiles of known threat actors: their tooling, targeting patterns and behaviour over time, so they get recognised faster the next time they show up.
Offensive AI Research
Red-teaming AI models and AI-powered products the way an attacker would — prompt injection, data extraction, jailbreaks, model manipulation — to find what breaks before someone else does.
Exploiting Known Vulnerabilities
Testing how already-disclosed vulnerabilities actually get exploited against real systems and business processes, not just whether a scanner flags them as present.
Offense builds it. Defense hardens it.
Velocity Lab's work sits on both frontiers of cyber security, and always in that order — understand how an attack actually works before building what stops it.
Offensive Security
We work closely with penetration testers, red team operators and advanced persistent threat (APT) researchers to build and run real offensive tradecraft — not theoretical attack models, but techniques exercised the way an actual adversary would use them.
Defensive Security
Once a technique is proven on the offensive side, the lab turns to stopping it — translating that insight into detections, countermeasures and hardened defences against that exact class of attack, and against organised cybercrime more broadly.
An AI model trained to run red team and pentest work
One active project is building the tooling itself, not just studying the target: an AI model trained to carry out red team and penetration testing work — reconnaissance, exploitation chaining, lateral movement and reporting — following the same tradecraft the team already studies in APT research and known-vulnerability exploitation.
What the model is trained to do
| Phase | What it does | Based on |
|---|---|---|
| Reconnaissance | Maps the target — exposed services, assets, entry points — before touching anything | Standard recon steps a human operator follows |
| Exploitation chaining | Links individual weaknesses into a working attack path, not isolated findings | Known-vulnerability exploitation research |
| Lateral movement | Tests how far an initial foothold can spread once inside a network | APT tradecraft research |
| Reporting | Produces findings mapped to real business impact, not a raw vulnerability list | Standard pentest reporting practice |
Why build this at all
| Human-led engagement | AI model, in development | |
|---|---|---|
| Frequency | Once or twice a year, typically | Can run continuously |
| Who's involved | A small number of specialist testers | The same researchers, reviewing and directing the model |
| Scope | Defined for that engagement | Same defined scope, repeated |
| Where it runs today | Customer-agreed environment | Velocity Lab's air-gapped environment only |
It's trained and tested entirely inside Velocity Lab's air-gapped environment, against the lab's own infrastructure, before any of it is considered for use elsewhere.
Built in confidence, with partners who've earned it
Velocity Lab researches, develops and prototypes sensitive technologies in confidential collaboration with two strategic partners already inside the OneFirewall ecosystem.
AquilaX
United Kingdom
OneFirewall's code and infrastructure assessment partner, now also working alongside Velocity Lab on sensitive, next-generation defensive research.
BondMesh
Belgrade, Serbia
Creator of the world's first autonomous AI Security Analyst, and a strategic AI partner, extending its research into Velocity Lab's own prototyping work.
Beyond AquilaX and BondMesh, Velocity Lab works with a wider network of researchers, red teams and threat-intelligence groups across the globe. Strict confidentiality governs every engagement, and information is never shared freely between what we deliver to OneFirewall customers and what happens inside the lab. The lab itself runs in an environment fully air-gapped from OneFirewall's production services — by design, not convenience.
This collaboration is strictly confidential by design. Beyond what's published here, we're not in a position to disclose further detail about the scope, methods or timelines of this work.
Vulnix0 — the first project out of Velocity Lab
Part of this initiative has already shipped. Vulnix0, OneFirewall's offensive security platform, was born inside Velocity Lab and is now operating live — running continuous DAST, dark-web exposure monitoring and attack-surface testing, enriched with the same alliance threat intelligence used across the rest of the platform.
Frequently asked
What is Velocity Lab?
OneFirewall's research and development team. It researches offensive and defensive security techniques and builds the technology the rest of the platform later uses, including Vulnix0.
Who works in Velocity Lab?
An extended team: OneFirewall's own researchers and engineers, working with partner organisations including AquilaX and BondMesh, plus a wider network of external researchers.
Is Velocity Lab connected to OneFirewall's production systems?
No. It runs in an environment fully air-gapped from OneFirewall's production services.
Can external researchers work with Velocity Lab?
Yes — through research collaboration, responsible disclosure, or joining the team. See the options below.
Does the AI red-teaming model replace human pentesters?
No. It's reviewed and directed by the same researchers who do the manual work. It extends how often testing can run — it doesn't replace the judgement a real engagement needs.
Is the AI pentest model used on customer environments?
Not yet. It's currently developed and tested only inside Velocity Lab's air-gapped environment.
How to work with Velocity Lab
There are three ways in: report a vulnerability, propose a research collaboration, or apply to join the team.
Responsible Disclosure
Found something in our platform? Report it through our published disclosure policy and our security team will respond directly.
Read the policy →Research Collaboration
Working on something that overlaps with data exfiltration defence, threat intelligence or offensive security tooling? Let's talk about collaborating.
Start a conversation →Join the Lab
Velocity Lab is growing. If full-time or contract offensive-security research is your world, reach out — we're always open to meeting serious researchers.
Get in touch →