A one-person security practice run by a director-level operator. Red team leadership, AI systems, and industrial networks.
Capacity-limited by design: three retainers, no team of forty, no 24/7 rota. If you need a firm with a rota, I will tell you which one to call.
I do three things: I take ownership of a red team programme that has lost its owner, I attack AI systems before someone else does, and I tell industrial companies what on their plant floor is reachable from the corporate network.
The engagement model is fractional because that is what fits an organisation that does not need a full-time head, cannot hire one, and does need someone accountable for the decisions.
What we do not sell
This list does more commercial work than anything above it.
- Compliance checkbox audits (ISO 27001 / SOC 2 gap assessments) — commodity, and somebody else's business model.
- SOC 24/7, MDR, on-call response — one person cannot sell a rota.
- Physical security deployment — licensed per jurisdiction, per state, per country. See below.
- Volume pentest-as-a-service — the margin is in volume, and volume needs a team.
- Hack-back, attribution services, counter-offensive — a felony in every jurisdiction where you operate.
- Exploit development for resale.
- Engagements that cannot be described on paper — defence, export-controlled or classified-adjacent work.
On physical security: licensing is issued per jurisdiction, and a firm that claims coverage it does not hold is the exact red flag you should run from. If your requirement is guards, sites and hardware, this is not the supplier.
