RedSecLabs: security research, threat intelligence, consulting.
The London-based cybersecurity firm behind Guardian Gaze. We do more than the plugin; and this page is the longer story.
What we do
RedSecLabs is a London-based cybersecurity firm. Our work spans offensive security research, web application security testing, and threat intelligence. Guardian Gaze is one product of that work, but it is not the whole of it.
Security research
Original research on browser security, web application vulnerabilities, supply-chain attacks and emerging malware techniques. Several findings have been recognised in industry hall-of-fame programmes and academic conferences.
Threat intelligence
We track real-world compromises across the WordPress ecosystem and turn what we find into pattern libraries, advisories and detection logic for Guardian Gaze.
Consulting
Selective engagements where web infrastructure carries real financial, regulatory or reputational consequences: code reviews, penetration tests and incident-response retainers.
Both started as incident work, not a roadmap
RedSecLabs is a security research practice with a background in offensive security and incident response. Guardian Gaze Limited is its product subsidiary, registered in England and Wales.
The WordPress plugin exists because of a pattern that kept recurring in cleanup work: a site would be cleaned thoroughly at the filesystem level, declared clean by several scanners, and reinfected within days. The payload had been in the database the whole time: a serialised value in wp_options, a fake transient, a hook that rewrote the files on the next page load. That is why database scanning is in the free plugin rather than behind a licence.
The enterprise platform exists because vendor security questionnaires kept describing organisations that looked entirely different from outside. A supplier would return a confident document while their actual external surface carried expired certificates, exposed management interfaces and mail records that let anyone send as them.
What gets built, and more often what gets refused
Coming from incident response rather than compliance tooling changes what you consider important. Severity ordering follows what actually gets exploited rather than what scores highest on a generic scale, and detection is built around the malware that has not been catalogued yet, because that is what is on the site nobody caught.
It also changes what we decline to claim. A team that has run incident response knows exactly what an external assessment cannot see, which is why the enterprise product states its blind spots on every module page rather than blurring them, and why the plugin's pages say plainly that some compromises sit outside what any WordPress plugin can reach.
The commercial expression of that is which parts are free. Detection is free and complete on the WordPress side (all four layers, including the database) because a scanner that will not tell you what is wrong without payment is not a scanner. What costs money is prevention, response, and the reasoning layer.
Where findings go when they are novel
Detection improves from samples, and the most valuable samples come from real compromises rather than from a corpus. Findings escalated by Agency customers reach the research team directly rather than a support tier, and genuinely novel samples end up improving detection for every user of the free plugin as well.
That loop is deliberate. The people who write a detection are the people who hear when it produces a false positive, and accuracy comes from that feedback rather than from a QA stage added afterwards.
It is also why we would rather have a corrected claim than a comfortable one. We have already removed a claim about a competitor's database scanning that our own research showed was inaccurate, and we would rather do that than defend it.
Why we built Guardian Gaze
For years we were called in to investigate WordPress compromises only after the damage was done, usually after traditional scanners had already declared the site clean. The plugin is our attempt to put what we know up front, where it can prevent the incident rather than explain it afterwards.
People and contact
Rafay Baloch
Security researcher with a long history of published findings on browser and web application security. Speaks regularly at industry conferences. CEO of RedSecLabs.
Research collaboration and press
For research collaboration, vulnerability disclosure unrelated to Guardian Gaze, or press requests. For Guardian Gaze security issues, use our disclosure policy.
[email protected]RedSecLabs Ltd
- Registered in
- England and Wales
- Registered office
- London, United Kingdom
- Founded
- 2026