“

It was always about making security work better

OUR STORY

It started with the hackers

Zerocopter was founded by hackers who saw that organizations needed a safer, more structured, and more accessible way to work with the hacker world.

Hackers are curious by nature. They look at systems differently, question assumptions, and find paths others miss. We built Zerocopter so that curiosity could help organizations find vulnerabilities, understand their exposure, and fix weaknesses before they become bigger problems.

That idea has shaped Zerocopter from the beginning and remains central to who we are today.

“

It was always about making security work better

OUR STORY

It started with the hackers

Zerocopter was founded by hackers who saw that organizations needed a safer, more structured, and more accessible way to work with the hacker world.

Hackers are curious by nature. They look at systems differently, question assumptions, and find paths others miss. We built Zerocopter so that curiosity could help organizations find vulnerabilities, understand their exposure, and fix weaknesses before they become bigger problems.

That idea has shaped Zerocopter from the beginning and remains central to who we are today.

“

It was always about making security work better

OUR STORY

It started with the hackers

Zerocopter was founded by hackers who saw that organizations needed a safer, more structured, and more accessible way to work with the hacker world.

Hackers are curious by nature. They look at systems differently, question assumptions, and find paths others miss. We built Zerocopter so that curiosity could help organizations find vulnerabilities, understand their exposure, and fix weaknesses before they become bigger problems.

That idea has shaped Zerocopter from the beginning and remains central to who we are today.

“

It was always about making security work better

OUR STORY

It started with the hackers

Zerocopter was founded by hackers who saw that organizations needed a safer, more structured, and more accessible way to work with the hacker world.

Hackers are curious by nature. They look at systems differently, question assumptions, and find paths others miss. We built Zerocopter so that curiosity could help organizations find vulnerabilities, understand their exposure, and fix weaknesses before they become bigger problems.

That idea has shaped Zerocopter from the beginning and remains central to who we are today.

Our purpose

Make security manageable.

01

What is connected to your organization

02

Where vulnerabilities may exist

03

Which findings are worth acting on

Our purpose

Make security manageable.

01

What is connected to your organization

02

Where vulnerabilities may exist

03

Which findings are worth acting on

Our purpose

Make security manageable.

01

What is connected to your organization

02

Where vulnerabilities may exist

03

Which findings are worth acting on

Our purpose

Make security manageable.

01

What is connected to your organization

02

Where vulnerabilities may exist

03

Which findings are worth acting on

What makes us different

Human creativity, supported by smart automation

We do not believe every task needs to be performed manually. We also don't believe automation replaces hackers.

Automation is excellent at discovering assets, running continuous checks, and identifying patterns at scale. Hackers are excellent at questioning assumptions, understanding context, finding unexpected paths, and uncovering weaknesses that tools may miss.

Zerocopter is built around using both where they add the most value.

What makes us different

Human creativity, supported by smart automation

We do not believe every task needs to be performed manually. We also don't believe automation replaces hackers.

Automation is excellent at discovering assets, running continuous checks, and identifying patterns at scale. Hackers are excellent at questioning assumptions, understanding context, finding unexpected paths, and uncovering weaknesses that tools may miss.

Zerocopter is built around using both where they add the most value.

What makes us different

Human creativity, supported by smart automation

We do not believe every task needs to be performed manually. We also don't believe automation replaces hackers.

Automation is excellent at discovering assets, running continuous checks, and identifying patterns at scale. Hackers are excellent at questioning assumptions, understanding context, finding unexpected paths, and uncovering weaknesses that tools may miss.

Zerocopter is built around using both where they add the most value.

What makes us different

Human creativity, supported by smart automation

We do not believe every task needs to be performed manually. We also don't believe automation replaces hackers.

Automation is excellent at discovering assets, running continuous checks, and identifying patterns at scale. Hackers are excellent at questioning assumptions, understanding context, finding unexpected paths, and uncovering weaknesses that tools may miss.

Zerocopter is built around using both where they add the most value.

There's more about Zerocopter

Our history

Zerocopter was founded by hackers. That's not a line we put on the website to sound interesting – it's the reason we work the way we do, and it's worth explaining what it actually means for you.

Our principles

With this blog, we would like to share with you the 5 principles we work by. They didn't come out of a workshop – they came out of practice, from choices we made over and over until they became the standard we hold ourselves to.

Some of them are older than the company. When the Dutch disclosure guideline was rewritten in 2018, the word "responsible" was replaced by "coordinated" – and that change says most of what we believe. Responsible put the weight on the person doing the reporting. Coordinated means together. We worked with the NCSC on that rewrite, and it still shapes how we approach every organization we take on.

It started with responsible disclosure

From distrust to collaboration - and why it still matters.

By Edwin van Andel

The Netherlands did not become one of the frontrunners in Coordinated Vulnerability Disclosure by accident. It happened because hackers, companies, government, police, prosecutors and the security community gradually learned how to solve a very practical problem together: what should happen when someone finds a serious vulnerability and wants to report it before criminals get the chance to abuse it?

Before there was a recognised process, reporting a vulnerability could be personally risky. The person trying to help could quickly become the problem.

The Dutch Responsible Disclosure guideline of 2013 changed that conversation. Organisations got a framework for receiving vulnerability reports, while researchers got a somewhat safer route for doing the right thing.

In 2018, the terminology changed from Responsible Disclosure to Coordinated Vulnerability Disclosure, or CVD. That might sound like a small detail. It isn't. The focus shifted away from judging whether the hacker had behaved "responsibly" and towards something much more useful: solving the problem together.

Today, with NIS2 implemented in the Netherlands through the Cybersecurity Act, vulnerability disclosure is no longer a progressive nice-to-have. It has become part of the wider expectation that organisations understand their digital risks, respond to them and work with the people who can help uncover weaknesses before criminals do.

That is why CVD matters. It turns curiosity into an early warning system, conflict into communication and individual vulnerabilities into resilience.

There's more about Zerocopter

Our history

Zerocopter was founded by hackers. That's not a line we put on the website to sound interesting – it's the reason we work the way we do, and it's worth explaining what it actually means for you.

Our principles

With this blog, we would like to share with you the 5 principles we work by. They didn't come out of a workshop – they came out of practice, from choices we made over and over until they became the standard we hold ourselves to.

Some of them are older than the company. When the Dutch disclosure guideline was rewritten in 2018, the word "responsible" was replaced by "coordinated" – and that change says most of what we believe. Responsible put the weight on the person doing the reporting. Coordinated means together. We worked with the NCSC on that rewrite, and it still shapes how we approach every organization we take on.

It started with responsible disclosure

From distrust to collaboration - and why it still matters.

By Edwin van Andel

The Netherlands did not become one of the frontrunners in Coordinated Vulnerability Disclosure by accident. It happened because hackers, companies, government, police, prosecutors and the security community gradually learned how to solve a very practical problem together: what should happen when someone finds a serious vulnerability and wants to report it before criminals get the chance to abuse it?

Before there was a recognised process, reporting a vulnerability could be personally risky. The person trying to help could quickly become the problem.

The Dutch Responsible Disclosure guideline of 2013 changed that conversation. Organisations got a framework for receiving vulnerability reports, while researchers got a somewhat safer route for doing the right thing.

In 2018, the terminology changed from Responsible Disclosure to Coordinated Vulnerability Disclosure, or CVD. That might sound like a small detail. It isn't. The focus shifted away from judging whether the hacker had behaved "responsibly" and towards something much more useful: solving the problem together.

Today, with NIS2 implemented in the Netherlands through the Cybersecurity Act, vulnerability disclosure is no longer a progressive nice-to-have. It has become part of the wider expectation that organisations understand their digital risks, respond to them and work with the people who can help uncover weaknesses before criminals do.

That is why CVD matters. It turns curiosity into an early warning system, conflict into communication and individual vulnerabilities into resilience.

There's more about Zerocopter

Our history

Zerocopter was founded by hackers. That's not a line we put on the website to sound interesting – it's the reason we work the way we do, and it's worth explaining what it actually means for you.

Our principles

With this blog, we would like to share with you the 5 principles we work by. They didn't come out of a workshop – they came out of practice, from choices we made over and over until they became the standard we hold ourselves to.

Some of them are older than the company. When the Dutch disclosure guideline was rewritten in 2018, the word "responsible" was replaced by "coordinated" – and that change says most of what we believe. Responsible put the weight on the person doing the reporting. Coordinated means together. We worked with the NCSC on that rewrite, and it still shapes how we approach every organization we take on.

It started with responsible disclosure

From distrust to collaboration - and why it still matters.

By Edwin van Andel

The Netherlands did not become one of the frontrunners in Coordinated Vulnerability Disclosure by accident. It happened because hackers, companies, government, police, prosecutors and the security community gradually learned how to solve a very practical problem together: what should happen when someone finds a serious vulnerability and wants to report it before criminals get the chance to abuse it?

Before there was a recognised process, reporting a vulnerability could be personally risky. The person trying to help could quickly become the problem.

The Dutch Responsible Disclosure guideline of 2013 changed that conversation. Organisations got a framework for receiving vulnerability reports, while researchers got a somewhat safer route for doing the right thing.

In 2018, the terminology changed from Responsible Disclosure to Coordinated Vulnerability Disclosure, or CVD. That might sound like a small detail. It isn't. The focus shifted away from judging whether the hacker had behaved "responsibly" and towards something much more useful: solving the problem together.

Today, with NIS2 implemented in the Netherlands through the Cybersecurity Act, vulnerability disclosure is no longer a progressive nice-to-have. It has become part of the wider expectation that organisations understand their digital risks, respond to them and work with the people who can help uncover weaknesses before criminals do.

That is why CVD matters. It turns curiosity into an early warning system, conflict into communication and individual vulnerabilities into resilience.

There's more about Zerocopter

Our history

Zerocopter was founded by hackers. That's not a line we put on the website to sound interesting – it's the reason we work the way we do, and it's worth explaining what it actually means for you.

Our principles

With this blog, we would like to share with you the 5 principles we work by. They didn't come out of a workshop – they came out of practice, from choices we made over and over until they became the standard we hold ourselves to.

Some of them are older than the company. When the Dutch disclosure guideline was rewritten in 2018, the word "responsible" was replaced by "coordinated" – and that change says most of what we believe. Responsible put the weight on the person doing the reporting. Coordinated means together. We worked with the NCSC on that rewrite, and it still shapes how we approach every organization we take on.

Boek een afspraak