TecSecurity is an Australian security research and consulting practice disclosing zero-day vulnerabilities across software and critical systems. We establish maximum security impact, prove exploitability, and work with affected vendors through coordinated disclosure.
Our client work includes source code review and penetration testing. Our independent work includes vulnerability research and bug bounty research.
What We Do
Our research team specialises in uncovering zero-day vulnerabilities across software and critical systems. We operate across the full vulnerability lifecycle, from discovery through vendor remediation and public disclosure.
Discovery – We audit complex, real-world codebases to identify impactful vulnerabilities that automated tooling misses. Our researchers work at the binary level, reversing and deconstructing proprietary software to surface reachable flaws in parsing logic, memory management, and trust boundaries. We prioritise vulnerabilities with the greatest potential impact across software and critical systems.
Impact – Finding a crash is not enough. We turn a promising primitive into the highest meaningful security impact, confirm the security boundary it crosses, and assess the practical attack surface it exposes.
Exploitability – We build reliable proof-of-concept code that demonstrates real-world impact. This includes validating primitives, establishing root cause, and reproducing the issue across relevant hardware revisions, firmware versions, and software builds.
Coordinated disclosure – We share actionable evidence with affected vendors, protect technical details while remediation is in development, support fix validation, and publish the public record after a patch is available.
Track Record
Our work is published through the Zero Day Initiative and coordinated directly with vendors including Google, Meta, Microsoft, Adobe, Siemens, Autodesk, Schneider Electric, and others. To date we have disclosed hundreds of vulnerabilities across widely deployed desktop applications, industrial systems, connected devices, and document processing software.
Browse our Advisories for the full disclosure history, or see our publicly released Exploits.
Recognition
TecSecurity founder Rocco Calvi received the ZDI Vanguard Award for Most Prolific Researcher at Black Hat USA 2025, recognising 300+ remote code execution vulnerabilities reported through the Zero Day Initiative – the world’s largest vendor-agnostic vulnerability acquisition programme.
Rocco was previously named a 2023 Microsoft Most Valuable Researcher by the Microsoft Security Response Center (MSRC) and ranked as a top three Microsoft Office researcher for the year.
PGP Key
For encrypted communications, use the following PGP public key:
- Key ID:
AF4AA46E50933325 - Fingerprint:
44BE DC3A 43B1 F394 BA67 2327 AF4A A46E 5093 3325 - Download: research-public-key.asc
Contact
For research inquiries, coordinated disclosure, or engagement opportunities:
- Email: research@tecsecurity.io
- X: @TecR0c
- LinkedIn: Rocco Calvi