Cybersecurity consulting
Independent consulting for technology companies, delivered directly by an experienced security practitioner. No account managers and no junior hand-offs.
Virtual CISO
Security leadership on a part-time basis, accountable to your management.
Ask about a virtual CISO- What it covers
- Security strategy and a prioritized roadmap
- Risk register, reporting to leadership and the board
- Policies, ownership and decision records
- Customer security questionnaires and audit preparation
- Who it is for
- Technology companies that need a security leader before they need a full-time CISO.
- The problem it solves
- Security decisions are being made by whoever is closest to the problem, with no one owning the overall risk.
Application Security
Hands-on review of how your software is designed, built and shipped.
Ask about Application Security- What it covers
- Threat modeling of new and existing systems
- Manual secure code review
- Triage of SAST, dependency and secret-scanning findings
- Guidance engineers can act on in the same sprint
- Who it is for
- Product and engineering teams shipping web applications and APIs.
- The problem it solves
- Scanners produce more findings than the team can read, and the real flaws are in the logic, not the list.
Authorized Penetration Testing
Scoped testing of web applications, APIs and infrastructure, only with written authorization.
Ask about Authorized Penetration Testing- What it covers
- Agreed scope, rules of engagement and written authorization before any testing
- Web application and API testing, including authentication and business logic
- External infrastructure testing
- A report with reproducible findings, impact and remediation, plus a retest
- Who it is for
- Organizations preparing a release, a customer review or an audit, or validating their own controls.
- The problem it solves
- You need evidence of how an attacker would actually get in, not a generic vulnerability count.
Vulnerability Assessment and Management
A working process for finding, triaging and closing vulnerabilities.
Ask about Vulnerability Assessment and Management- What it covers
- Assessment of code, dependencies and cloud configuration
- Triage that separates real findings from noise
- Prioritization against business impact
- Remediation tracking and ownership
- Who it is for
- Teams whose scanner backlog has grown faster than their ability to fix it.
- The problem it solves
- Thousands of open findings, no shared view of which ones matter, and no one sure what was already fixed.
Security Architecture
Design review for cloud platforms, identity and data flows.
Ask about Security Architecture- What it covers
- Review of cloud and network architecture
- Identity, access and secrets management design
- Tenant isolation and data protection patterns
- Architecture decision records with security trade-offs
- Who it is for
- CTOs and platform teams designing new systems or reworking existing ones.
- The problem it solves
- Security issues that are cheap to fix on a whiteboard become expensive once they ship.
- What it covers
- Security requirements and design review gates
- SAST, dependency and secret scanning in CI
- Code review guidance and developer training
- Release criteria that are realistic for the team
- Who it is for
- Engineering organizations that want security to be part of delivery rather than a final checkpoint.
- The problem it solves
- Security reviews happen too late, block releases and are skipped when deadlines are close.
Security Governance and Risk Management
Governance that maps to recognized frameworks without becoming paperwork.
Ask about Security Governance and Risk Management- What it covers
- Risk assessment and a maintained risk register
- Alignment with frameworks such as ISO/IEC 27001, SOC 2 and NIST CSF
- Policies and controls sized to the organization
- Tracking of regulatory and standard changes that affect you
- Who it is for
- Companies facing customer due diligence, certification or new regulatory obligations.
- The problem it solves
- Customers and regulators ask for evidence of control, and the answers are scattered across people and documents.
Security Operations and Incident Response
Preparation for incidents and support when one happens.
Ask about Security Operations and Incident Response- What it covers
- Incident response plans and playbooks
- Logging and detection coverage review
- Tabletop exercises with engineering and leadership
- Hands-on support during and after an incident
- Who it is for
- Teams without a dedicated security operations function.
- The problem it solves
- When something goes wrong, nobody knows who decides, what to collect or whom to notify.
AI-Assisted Security Engineering
Practical use of AI in security work, with people kept in control of decisions.
Ask about AI-Assisted Security Engineering- What it covers
- AI-assisted threat modeling and code review workflows
- Validation of scanner findings with human sign-off
- Design of review steps so AI output is checked against evidence
- Security review of AI features in your own product
- Who it is for
- Security and engineering teams adopting AI tools, or building AI into their products.
- The problem it solves
- AI can speed up security work, but unchecked output creates false confidence instead of fewer risks.
How an engagement runs
Step 1
Scope
A short call or email exchange to agree on goals, systems in scope and constraints.
Step 2
Agreement
Written scope and terms. For penetration testing, written authorization from the system owner.
Step 3
Work
Hands-on delivery with regular check-ins, not a handover at the end.
Step 4
Report
Findings with evidence and concrete next steps, written for both engineers and management.
Testing of any system happens only within an agreed scope and with written authorization from its owner. Results depend on scope, access and time; no engagement can guarantee the absence of vulnerabilities.
Tell us what you are trying to secure.
A short email is enough. You will get a reply from the person who would do the work.