Find the gaps before someone else does

What that looks like

• Full-stack gap assessment

  I trace the whole path rather than one layer of it: the agent and application layer, the services behind them, and the infrastructure and network underneath. Most of the findings worth having live at the seams between those layers, where each side assumed the other was enforcing something. You get the gaps and a prioritized roadmap to close them.

• Purple-team engagement

  I run the attacks alongside your team instead of at them. We work through what actually gets through, then improve the controls and the detection together, so the engagement ends with your defenses measurably better rather than with a list of findings and a bill.

• Training and workshops

  Hands-on sessions for the engineers shipping this, and briefings for the executives funding it. Same material as the labs I publish, run against your architecture instead of a toy one.

Who it's for

Teams running something that can touch something real: a customer record, a payment, an internal service, another system. AI agents are the newest version of that problem and the one I write about most, but the shape is an old one. Something is trusted with more reach than anyone intended, and the layer above assumed the layer below was checking.

That is why I don't stop at the application. A finding at the agent layer is often only interesting because of what the network or the identity configuration underneath it allows, and you cannot see that from one end.

If you're still prototyping, the free writing and labs are probably a better use of your money than I am. Come back when it's wired into production.

Start a conversation

Tell me what you're building and what worries you about it. I read everything that comes through here and reply personally. No sequence, no SDR, no calendar wall.