Evidence over alarm
Every finding comes with the exact observation behind it and a command you can run to reproduce it. If I cannot show it, I do not say it.
About
A one-person practice, deliberately.
You are hiring the person who does the work, not an account manager who forwards it. That is the whole staffing model, and it is why the scope is small enough to finish.
What I actually do
I look at what a public website says about itself — the version of the language or content management system it reports — and compare that to what is currently supported. When there is a gap, I fix it under a written scope and prove the fix. When there is no gap, I say so and the engagement ends.
A meaningful part of the work is explaining which of your systems you actually control. Organizations frequently believe they have a server when they have a hosting account, and believe they have an IT department when they have a vendor. Getting that straight changes both the fix and the price.
I also do the ordinary consulting that surrounds it: migrations, account and permission reviews, documentation for systems that live in one person's head, and backup restores that have been tested at least once.
Background
My public track record is threat research. In 2016 I was credited in Schoolbell and the Kingslayer, the RSA FirstWatch presentation at GoSec on a campaign that had infected roughly two thousand internet-facing servers through unpatched Java application servers. I was a contributor to that effort, not its author.
That work is why I price a version change at a few hundred dollars instead of quoting a program: the exposure is real, but the fix is usually ordinary. It is also why I am blunt about the limits of what one person can do. A campaign of that size is not stopped by a consultant. It is prevented, slowly, by organizations that know what they are running.
How I work
The smallest fix that works
Not every exposure needs a project, a platform, or a retainer. Some need a dropdown and a verification. I will tell you which, including when it means a smaller invoice.
Documents, not dashboards
You get something you can attach to a budget request, hand to an auditor, or read six months from now without me in the room.
No lock-in
No proprietary tooling, no agent installed on your machines, no dependency on me to read your own report. Everything is written to be usable without me.
What I am not
Not a managed security provider, not a 24/7 SOC, not a penetration-testing firm, and not a reseller. I do not carry product quotas, I do not earn commissions on recommendations, and I do not have a bench of analysts to staff a large program.
If your need is bigger than one careful person, I will say that on the first call and point you toward the kind of firm you actually need. It costs me a lead and saves you a quarter.
Talk to the person who does the work.
No discovery sequence, no calendar link that leads to a sales engineer. One email reaches me.