Security work, delivered as code.
We review the software you ship, build the detections that catch attacks against it, and turn up when something goes wrong. What we build for you lives in git, gets reviewed in pull requests, and is tested in CI.
Design and code review for the software you ship.
We read the design and the code, then tell you where the trust boundaries sit. Threat models name the attackers and assets that matter to your system, and every finding comes with the code path that produces it.
Findings arrive as a written report the owning team can act on: severity, reproduction steps, and a suggested fix. We are happy to sit with the engineers who have to make the change.
Correlation rules that live in git and ship through CI.
Every rule lives in your repository as code. Schema validation, linting, and live query-syntax checks run on each pull request, so a broken detection fails the build before it reaches the SOC.
A status field controls which environment a rule can reach, so a rule’s maturity and its blast radius move together. Rules run from experimental to test to stable to deprecated, and every promotion is a pull request with a reviewer.
Help when something is already happening.
We work the incident alongside your team: scoping what is affected, containing it, and building the timeline of what happened. You get the written record while it is still accurate.
Afterwards we turn the incident into detections and a runbook, so the next one is caught earlier and handled the same way twice.
Endpoint policy and response procedures managed as code.
Host groups, prevention policies, and sensor update policies become reviewable Terraform. Every change carries a plan and a stated blast radius, and scheduled drift detection flags anything changed out of band.
Runbooks work the same way. One file that a Tier-1 analyst reads and an agent executes, with every step tagged auto, approval-required, or human-only, so the written procedure and the automation stay in step.
Those are our strengths. Security work rarely stays inside neat categories, so if you have something next to this list, ask.
Good reasons to email: a release you want looked at before it ships, gaps in detection coverage, a tenant that has drifted from what anyone intended, or something happening right now.