Skip to content
What we do

Two practices, one standard.

They are different disciplines with a shared constraint: both are about what an organization exposes, and what it does not.

One is the systems — how an environment is segmented, what can reach what, and what happens when something is wrong. The other is the organization’s reach: who it hires, who it sells to, and what it publishes doing both.

The standard is the same for both: nothing is claimed that cannot be shown.

The shape of a protocol

Three stages, and the two gaps between them.

Most organizations have all three. Far fewer have a named owner at the handoffs, which is where the hours actually go.

01

Detection

Something is wrong and somebody knows. The measure here is the detection, not the attacker.

02

Containment

Stop the spread before understanding the whole picture. Deliberately not the same as eradication.

03

Recovery

The part that decides how long a bad day lasts. It is a business decision wearing technical clothes.

Where we are

Early, and specific about it.

Stage
Pre-product
In development. No shipped product, no customers, and no claims that depend on either.
Based
New Jersey, USA
Operating from New Jersey.
Contact
Open to conversation
We are talking to people whose problems are close to what we are building.

Nothing on this site is available for purchase. We are building, not selling. If the work is relevant to yours, the fastest route is to write to us.

Auctoritas was the Roman word for standing that came from track record — distinct from potestas, the power to compel. It was earned, and it could be lost.

It is an unusual name for a company with nothing shipped, and that is deliberate. In defensive security the claim always arrives before the evidence. We would rather be measured against the standard than borrow it.

The standard

What we will not do.

An offer is free to write. A refusal costs something, which is why it is the more useful half to publish.

  1. 01
    Build offensive tooling, or publish exploit detail and specific offensive capability — including our own.
  2. 02
    Describe capability we have not built, or name a customer we do not have.
  3. 03
    Publish customer-identifying security architecture. Yours or anyone else's.
  4. 04
    Treat a check that did not run as a check that passed.
Get in touch

Tell us who you are and what you are working on.

We read everything.