Consulting & Audit

󰈉 audit --scope stack --evidence reproducible

󰣨 audit --inventory --exposure --posture

󰄬 inventory observed hosts · services · open ports · DNS · mail · backups

󰄬 exposure tested firewall · SSH paths · TLS · authentication

󰄬 config read declarative source, or the live state

󰈉 report written findings ranked · evidence attached

Start With an Audit

Not ready to commit? Start with an audit. This is a scoped, one-off review of the state of your stack: what you actually run, what is exposed, what is not enforced the way you think it is — delivered as a written report where every finding is reproducible, not a score out of ten.

What I deliver:

An inventory of what is really running — hosts, services, ports open to the internet, DNS, mail, backups
A security review: firewall rules, SSH access paths, TLS, authentication, secret handling
A configuration review against your declarative source (NixOS, Ansible, Terraform) — or against the live state, if there is no source to read
The logging posture, checked behaviourally rather than read off a config file: re-apply the setting, send a probe, then look for what was written
Performance and cloud-spend findings, each with the number that justifies it
Findings ranked by what to fix first, with the evidence for each attached

You get:

A report you can hand to your own team or your board, because each finding can be re-run
A remediation roadmap scoped to your budget rather than a wishlist
No sales pitch: the deliverable is the document, whether or not you hire me to do the fixing

What It Is Not

It is not a certification audit and not an independent opinion. I am one engineer giving you an assessment of your own infrastructure; nothing in the report implies an accredited certification or a third-party attestation, and it will state which areas were checked and which were not. The vocabulary this site permits itself around certifications is set out on Standards & Claims.

The Same Method I Run on My Own Fleet

The audit I run on my own fleet daily — invariant checks, an ed25519-signed report per host, published keys, monthly roll-ups that freeze once closed — is described at Infrastructure Audit. A client engagement normally stops well short of that, but it is the same method and the same standard of evidence.

Findings Land as Work, Not as Slides

Each finding names the resource, the observed behaviour, the risk it represents, and the change that closes it. Where a finding belongs to one of the other disciplines, the report points at the page that covers it: Security Engineering for the controls, Monitoring & Observability for the telemetry that proves they stay in place, Infrastructure as Code & DevOps for making the fix declarative.

󰈉 Written Report

󰄬 Reproducible Findings

󰋖 Scoped to Your Budget

󰦝 No Sales Pitch

󰔟 Find out what your stack is actually doing.

Send me the shape of your environment — providers, host count, whether there is a declarative source — and the question you need answered. I'll come back with the scope, the deliverable and the timeline.

[ REQUEST AN AUDIT ]