Receipts, not slides.
Anonymised by default, sharable on request with NDA. A sample of what six months of FirmBit looks like.
Stopped a $2.4M wire-fraud path before the SOC 2 audit
Uncovered an IDOR in the payout engine and three BAC findings in admin routes. Fixed before the auditor opened the laptop.
HITRUST r2 Certified in 104 days
From gap assessment to certification, including 311 CSF controls mapped and 47 evidence artifacts authored.
Patched prompt-injection and RAG data-exfil paths
Three jailbreak chains + a vector-store RCE. Shipped a hardened RAG pipeline and an eval harness to keep it hardened.
StateRAMP moderate authorized in one submission
SSP authoring, 3PAO coordination, and continuous monitoring setup — first-pass accepted by state PMO.
Scope reduction cut PCI footprint by 74%
Tokenisation + P2PE pathway reduced in-scope systems from 143 to 37. RoC issued without compensating controls.
Assumed-breach in 4 hours, domain admin in 18
Purple-team exercise mapped to MITRE ATT&CK. Delivered 23 detection improvements to blue team.