A static report.
A firm arrives, runs tests, writes a report, and leaves. The client files the report and waits for next year. People are hired. Vendors change. The report doesn’t.
Mid-market manufacturing & industrial
We travel to your facility. We find what gets through. Then we keep finding it, automatically, until we come back.
Physical audits. Continuous AI-driven simulation. Point-in-time assessments tell you where you were. We tell you where you are: this week, this department, this technique, this person.
The problem with how security is done
Phishing simulations run quarterly if you’re disciplined. Physical assessments happen annually if you’re well-funded. The attacks happen every day.
A living picture.
An adaptive simulation layer that runs continuously between audits. If a technique works, it escalates. If a department is consistently vulnerable, it concentrates there.
The engagement
One program. Two surfaces. Continuous.
The audit informs the simulation. The simulation informs the audit. They are one program, not a project followed by a subscription.
01 On-site
We travel to your facility.
We walk the floor. We observe operations. We test physical access controls and the human surfaces no remote tool can see. We run initial adversarial simulation across every relevant vector and document a baseline: what’s exposed, why it matters, what fixing it would require.
physical access
social eng
phishing
vishing
02 Continuous
The simulation keeps running.
An AI-driven layer runs continuously between engagements. Automated OSINT. Adaptive spear phishing. Vishing using current attack techniques. The system doesn’t run the same test twice; it learns what works against your specific organization and adapts.
osint
adaptive phish
voice clone
iterate
03 Review
We alternate. The cycle compounds.
Digital review years: findings from the automated layer are compiled and presented, first internally, then directly with us. No travel. No ceremonies. Physical audit years: we return on-site. Findings from the automated layer inform where we look.
digital yr
physical yr
recalibrate
Engagement cycle · 4 years shown
Initial audit
on-site
2026
Continuous
retainer
Digital review
no travel
2027
Continuous
retainer
Physical audit
on-site
2028
Continuous
retainer
Digital review
no travel
2029
Continuous
retainer
Physical: on-site
Digital: remote
Continuous simulation runs underneath both.
What runs against your people
Named techniques. Real tools.
Iterating on real outcomes.
Not “threat simulation.” The specific tradecraft that lands on your employees: on a continuous schedule, adapting to what gets through.
Automated OSINT
T-01Continuous open-source intelligence on the organization and its people. The same reconnaissance an attacker runs, before the attack lands.
Targets: org · individualsAdaptive spear phishing
T-02LLM-personalized to role, recent activity, and prior outcomes. Pretexts iterate on what’s clicked. No two payloads are identical.
Vector: emailVishing & voice cloning
T-03Voice-cloned calls modeling internal authority. Tests the path from inbound call to disclosed credential, wire detail, or unlocked door.
Vector: voicePhysical access
T-04Tailgating, badge cloning, propped-door discovery, vendor pretexting. The audit informs which doors and which people get tested next.
Vector: on-sitePretext & social
T-05Multi-channel pretexts that combine OSINT, email, and voice. The system escalates only along the paths that have already shown traction.
Vector: multi-channelFindings & iteration
T-06Every result is logged: which technique, which department, which person, which time of day. Next week’s simulation is built from this week’s data.
Output: structured findingsWhat makes this different
You cannot audit the human element from a dashboard.
Physical and digital are one surface.
The audit informs the simulation. The simulation informs the audit. They are one program.
Continuous, not episodic.
Point-in-time assessments tell you where you were. The automated layer runs every day between your physical engagements.
Adaptive, not scripted.
Most simulations run the same scenarios on a schedule. Ours iterate based on real outcomes. If a technique works, we escalate it.
We are present.
We travel to you. The founder does the work. No delegation to junior staff. This is structural, not a preference.
Operators, not consultants
The systems we audit are the systems we’ve operated.
Two founders from the manufacturing floor. An investor from the same world. The firm is built by and for the operators it serves.
DA
David Ashby
Quality · compliance · automationQuality, safety, and compliance background at Quality Electrical Systems, a manufacturer of e-houses and PDC buildings for utility-scale electrical infrastructure. Top 3 creator on n8n.io. Builds the continuous simulation layer directly.
JW
James Wall
Quality eng · IT · social engQuality Engineer at Quality Electrical Systems. Background in IT infrastructure, hands-on networking implementation, and social engineering. Ex-Amazon, with supply chain experience. Operates across systems-of-systems.
BP
Brady Parkin
Control panels · UL 508A · NECManufacturing operator. Fabricated and wired control panels for utility substation relay applications and industrial automation systems. Designed custom test equipment to UL 508A and NEC standards. Former foreman.
Founding client program
Two spots open. Locked-in pricing. Direct line.
We are onboarding three founding clients. One spot is already in progress. Two remain: one through a warm referral path, one open to direct application. If you’re reading this and we haven’t spoken yet, this is the spot you can move on.
Spot 01
In progress
Relationship · in conversation
Spot 02
Open
Referral · warm intro preferred
Spot 03
Open
Direct · move first
Founding clients receive
- Rates locked in for three years, below where new client pricing will land
- Direct access throughout every engagement, not delegated to junior staff
- Input into how the service develops as we scale
- Recognition as a founding client organization, at your discretion
We ask in return
- Honest feedback throughout the engagement
- Reference-ability once results are established
- Case study rights, scope agreed in advance
Apply