Services
Security-critical work, done in-house.
Every engagement is scoped in writing, priced up front and delivered by the people you spoke to. Here’s what that covers.
Post-quantum cryptography
Cryptographic inventory
We find every place your systems use RSA, ECDH, ECDSA and friends, in code, certificates, protocols, HSMs and vendors, and rank each by exposure.
Harvest-now, decrypt-later review
Traffic recorded today can be decrypted once large quantum computers exist. We identify the data that has to stay secret long enough to matter and protect it first.
Hybrid migration
Hybrid key exchange (classical plus ML-KEM) and signature roll-outs planned so nothing breaks for clients that haven’t upgraded.
Hash-based signatures
LMS, XMSS and SLH-DSA for firmware signing, code signing and long-lived roots of trust, including the state management stateful schemes require.
Cryptocurrency & custody
Custody architecture
Hot/warm/cold design, multisig and MPC trade-offs, withdrawal policy and the approval flows that stop a single compromised laptop from draining a treasury.
Signing infrastructure
Signing services, HSM integration and key ceremonies with documented, repeatable procedures.
Smart-contract audits
Manual review for re-entrancy, access control, oracle manipulation, upgrade risks and economic attacks, plus tests that prove each finding.
Incident tracing
When funds have already moved, we trace them across wallets, bridges and exchanges and document the trail for counsel and law enforcement.
Offensive security
Penetration testing
Web apps and APIs, cloud and IAM, internal and external networks, and mobile. How we run a test →
Red teaming
Objective-based adversary emulation that tests detection and response, not just the perimeter.
Source code review
White-box review of the code that matters most, with findings traced to the exact line.
Cryptographic review
Protocol and implementation audits: randomness, nonce handling, key lifecycle and side channels.
Engineering & leadership
Custom builds
Security-critical services, protocols and internal tools, designed and tested by the same people who break systems for a living.
Fractional CTO
Architecture, security posture, hiring and roadmap ownership for teams that need senior judgment without a full-time executive.
Have a system that has to hold?
Tell us what you're protecting and when it has to be ready. You'll get a straight answer on scope, timeline and price, usually within one business day.