Notes from the field.
Practical security guidance and clear explainers on offensive security, external exposure, and cyber hygiene.
Three Local Models, and the Two Attacks That Beat All of Them
We ran seventeen adversarial prompts at three local language models. The toughest one refused fifteen. The two that got through it were not the clever ones. They were the ones that arrived through a channel the model already trusted.
Read →Put Weight On It: An Open LLM Red-Team Lab
Most teams ship an LLM feature after prompting it a few times and calling it safe. We built a local-first, open-source harness that puts real adversarial pressure on a model and scores what breaks: 50 cases across 10 attack categories.
Read →Security Assessment Before a SOC 2 Audit: What You Actually Need
SOC 2 doesn't name a penetration test as a hard requirement, but its criteria expect vulnerability management, and an external exposure assessment beforehand is the cheapest way to avoid findings. Here's what to run, and when.
Read →External Exposure Audit vs. Penetration Test: Which Do You Need?
An external exposure audit maps what's reachable and misconfigured across your public footprint. A penetration test proves how far an attacker could actually get. Here's how they differ and how to choose.
Read →Emulate, Detect, Evolve: An APT33 Adversary-Emulation Case Study
A public-safe walkthrough of emulating APT33-like behavior in a controlled lab to validate detection coverage: the ATT&CK mapping, the Sigma and Splunk artifacts, and what the telemetry actually caught.
Read →What Is an External Attack Surface?
Your external attack surface is everything an attacker can see and reach from the public internet, without any insider access. Here's what it includes, why it grows on its own, and how to get visibility into it.
Read →Penetration Test vs. Vulnerability Scan: What's the Difference?
A scanner tells you what might be wrong. A penetration test shows you what an attacker could actually do. Here's why that distinction matters, and when to use each.
Read →Cybersecurity Best Practices for You and Your Household
A practical, no-jargon guide to protecting your devices, accounts, and home network, whether you're a tech pro or a casual internet user.
Read →Ready to find out what's exposed?
Book a short call, tell us what you're running, and we'll scope the right engagement.