Operand / infrastructure security engineering
Most security is a promise.Ours ships with evidence.
We build and operate the cryptographic, identity and industrial-control security regulated organizations are now required to have. On live systems. With test results, measurements and a rehearsed way back.
// the problem
Every regulated organization now carries the same engineering debt. It is not on the balance sheet. It lives in the handshake, the credential and the plant floor. And it comes due on a date someone else has already set.
// the clock
The dates are already set. Not by you.
47 days
Public certificate lifetimes, 2029.
The CA/Browser Forum has set the schedule. Manual renewal stops being an option long before the last step.
FIPS 203 · 204
Post-quantum is a standard now.
ML-KEM and ML-DSA are published. Supervisors already ask for the roadmap. Next they will ask for the migration.
DORA · NIS2
Recovery has to be tested, not promised.
Access control, supplier risk and resilience must be evidenced. A policy document is not evidence.
// how an engagement runs
We are engineers, not advisors. Three verbs, in this order, every time.
Build it.
Prove it.
Run it.
Key infrastructure, identity systems and industrial-security controls, built on your live systems. Not described in a deck.
// three acts
Don't take our word for it. Watch the terminal.
Each service below is shown the way we deliver it: as commands, output and a result you can rerun. Scroll, and the session plays.
Act I / Cryptographic infrastructure
Replace an algorithm without redesigning the system.
Private PKI, HSM and key management, certificate lifecycle automation, and post-quantum migration of TLS, signing and key exchange. Including the plant and control networks nobody else wants to touch.
- You get
- Key infrastructure in which algorithms and keys can be swapped; migrated systems with test results and a rehearsed rollback; an operations contract that keeps it that way.
- Not included
- Inventories, risk registers, roadmaps, or an opinion on whether a system should migrate.
$ git diff conf.d/gw.example.com.conf ssl_protocols TLSv1.2 TLSv1.3;- ssl_ecdh_curve X25519:prime256v1;+ ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;$ openssl list -tls-groups | tr ":" "\n" | grep -x X25519MLKEM768X25519MLKEM768$ nginx -t && nginx -s reloadnginx: configuration file /etc/nginx/nginx.conf test is successful$ openssl s_client -connect gw.example.com:443 -groups X25519MLKEM768Negotiated TLS1.3 group: X25519MLKEM768# ok: hybrid post-quantum key exchange$ openssl s_client -connect gw.example.com:443 -groups X25519Peer Temp Key: X25519, 253 bits# ! classical only: reported as a fallback, not a success# rollback rehearsed: previous file restored, nginx -t passed, classical handshake confirmed$ Act II / Identity and secrets engineering
Credentials that expire on their own.
Workload identity, the end of long-lived secrets, machine and agent identity. IAM built, then operated. A key that lives forever is a breach that has not happened yet.
- You get
- Credentials that expire, federate and can be audited, for people, services and agents; long-lived secrets removed from code, pipelines and configuration; an operator for all of it.
- Not included
- Identity governance consulting, licence resale, help-desk operation.
$ cat /etc/ssh/sshd_config.d/10-user-ca.conf+ TrustedUserCAKeys /etc/ssh/user_ca.pub+ AuthorizedKeysFile none+ PasswordAuthentication no$ sshd -t && systemctl reload ssh$ ssh-keygen -s user_ca -I deploy@ci -n deploy -V +15m id_ed25519.pubSigned user key: id "deploy@ci" valid from 2026-10-20T08:17:00 to 2026-10-20T08:33:29$ ssh deploy@host.example.com 'whoami'deploy# ok: fifteen-minute certificate accepted# sixteen minutes later, the server log shows:Certificate invalid: expired$ ssh -i ~/.ssh/legacy_ed25519 deploy@host.example.comdeploy@host.example.com: Permission denied (publickey).# ok: long-lived key refused. Nothing to steal that lasts.$ Act III / Recovery engineering
After a breach, a measured way back.
Rebuilding after an incident, and the recovery and resilience testing your regulator now requires. Not a promise of resilience. A stopwatch.
- You get
- Rebuilt systems with new trust roots and credentials; recovery tested, with measured times; the evidence your regulator asks for afterwards.
- Not included
- 24/7 incident retainers, managed detection, forensics for litigation.
# scenario: identity provider compromised. Trust nothing it signed.$ recovery plan --scenario idp-compromise --objective 4h[1/5] trust roots new offline root generated in HSM, old root distrusted[2/5] credentials every token, key and certificate revoked and reissued[3/5] systems rebuilt from known-good images, not cleaned in place[4/5] recovery test restore measured end to end elapsed 3h 12m · objective 4h · within objective[5/5] evidence report written: verified / told / not observed# ok: ready for the regulator, with times instead of adjectives$ // the lab
Our own agent runtime. Inside your perimeter.
One controller coordinates a group of agents per asset. Each discovers, reviews configuration, analyses logs and collects evidence, then hands the finding to a named owner. No data leaves. Nothing changes on its own.
In development, applied to our own engagements first. Each agent role is tested against its own objective before it is used on a client system.
runtime.log, simulated session
// how we report
Every report is written in three tenses.
What we verified, what we were told, and what we could not observe are three different things. We never blur them, because your regulator will not.
Verified
We ran it, measured it, and can show you the output. This is the only column we call a fact.
Told
Someone on your side said so, and we wrote down who. Useful. Not the same thing.
Not observed
We could not see it. We say so, instead of letting silence read as a pass.
// what we refuse to sell
- Assessments, audits and gap analyses
- Strategy decks and maturity scores
- Licence resale and tool marketing
- Juniors learning on your production
- A fallback reported as success
// small by design
Every engagement is run by senior engineers who have built this before. The people who scope your project are the people who deliver it.
// alongside your advisor
Already working with a consultancy or an assessor? Good. They tell you what has to change. We are the team that changes it, and hands their auditors the evidence.
// we build against
- NIST FIPS 203 · 204 · 205
- CA/Browser Forum
- DORA
- NIS2
- IEC 62443
// next step
Tell us what has to change, and by when.
A thirty-minute scoping call with the engineers who would do the work. You leave with a written view of what we would build, how we would prove it, and what we would not touch.