Services

Security work on both sides of the line, pragmatic AI, and the architecture and code underneath it all.

Security

  • Red team

    Find the holes before someone else does. Scoped adversary emulation and penetration testing, run only under written authorization and agreed rules of engagement.

    • Web application and API testing
    • External and internal network testing
    • Cloud account and identity misconfiguration review
    • AI and agent security testing
    • Reports with reproducible steps and prioritized fixes

  • Blue team

    Make attacks loud and recovery boring. Hardening, visibility and response planning for the systems you already run.

    • Threat modeling and attack surface review
    • Logging, monitoring and detection engineering
    • System, identity and cloud hardening
    • Incident response plans and tabletop exercises

  • Bug bounty & disclosure

    Give researchers a clear way in. Set up and run a vulnerability disclosure or bug bounty program that your team can actually keep up with.

    • Disclosure policy, scope and safe-harbor wording
    • security.txt and intake workflow
    • Report triage, validation and severity rating
    • Fix verification and researcher communication

  • Governance & risk

    Guardrails that keep up with the business. Practical security and AI governance: clear policies, real risk decisions and compliance without the paperwork theater.

    • Security and AI policies people actually follow
    • Risk assessments and AI use inventories
    • Vendor and third-party AI risk review
    • Compliance readiness for the standards customers ask about

AI

  • Pragmatic AI-native

    AI where it earns its keep, not where it makes a good demo. Products and workflows designed around models from day one, with evaluation, cost and security planned in rather than bolted on.

    • Finding where AI actually helps, and where it doesn't
    • AI features, agents and retrieval in real products
    • Evaluations, guardrails and cost controls
    • On-device and private models when data can't leave

  • AI enablement & training

    Get your team using AI well, not just using it. Hands-on training and workflow design built around the work your people already do.

    • Hands-on workshops for engineering and non-engineering teams
    • Agentic coding, review and testing
    • Team playbooks and reusable agent workflows
    • Usage policies covering data, privacy and security

Architecture & development

  • Cloud architecture

    Cloud foundations that stay secure, reproducible and affordable as they grow.

    • Account structure, networking and identity design
    • Infrastructure as code and deployment pipelines
    • Reliability, backup and disaster recovery planning
    • Cost and architecture reviews

  • On-premises & hybrid

    Not everything belongs in the cloud. Design, modernize or connect the infrastructure you own.

    • Network, virtualization and storage design
    • Directory and identity integration
    • Hybrid connectivity between on-prem and cloud
    • Migration planning — in either direction

  • Application development

    Apps and tools built with the same care as the ones in the projects list, from first prototype to shipped release.

    • Web applications and APIs
    • Native Apple platform apps
    • Internal tools and automation
    • Security reviews of existing codebases

Got something in mind? Drop a line at [email protected].