Consulting & Audit

audit --scope stack --evidence reproducible

audit --inventory --exposure --posture

inventory observed hosts · services · open ports · DNS · mail · backups

exposure tested firewall · SSH paths · TLS · authentication

config read declarative source, or the live state

report written findings ranked · evidence attached

Start With an Audit

Not ready to commit? Start with an audit. This is a scoped, one-off review of the state of your stack: what you actually run, what is exposed, what is not enforced the way you think it is — delivered as a written report where every finding is reproducible, not a score out of ten.

What the audit covers:

An inventory of what is really running — hosts, services, ports open to the internet, DNS, mail, backups
A security review: firewall rules, SSH access paths, TLS, authentication, secret handling
A configuration review against your declarative source (NixOS, Ansible, Terraform) — or against the live state, if there is no source to read
The logging posture, checked behaviourally rather than read off a config file: re-apply the setting, send a probe, then look for what was written
Performance and cloud-spend findings, each with the number that justifies it

The deliverable is a report you can hand to your own team: every finding can be re-run, the fixes are ordered by what to do first, and the remediation list is scoped to your budget rather than to a wishlist. There is no sales pitch attached — the document is the work, whether or not you hire me to do the fixing.

What It Is Not

It is not a certification audit and not an independent opinion. I am one engineer giving you an assessment of your own infrastructure; nothing in the report implies an accredited certification or a third-party attestation, and it will state which areas were checked and which were not. The vocabulary this site permits itself around certifications is set out on Standards & Claims.

The Same Method I Run on My Own Fleet

The audit I run on my own fleet daily — invariant checks, an ed25519-signed report per host, published keys, monthly roll-ups that freeze once closed — is described at Infrastructure Audit. A client engagement normally stops well short of that, but it is the same method and the same standard of evidence.

Findings Land as Work, Not as Slides

Each finding names the resource, the observed behaviour, the risk it represents, and the change that closes it. Where a finding belongs to one of the other disciplines, the report points at the page that covers it: Security Engineering for the controls, Monitoring & Observability for the telemetry that proves they stay in place, Infrastructure as Code & DevOps for making the fix declarative.

Written Report

Reproducible Findings

Scoped to Your Budget

No Sales Pitch

Find out what your stack is actually doing.

Send me the shape of your environment — providers, host count, whether there is a declarative source — and the question you need answered. I'll come back with the scope, the deliverable and the timeline.

[ REQUEST AN AUDIT ]