Projects I have worked on outside client engagements. Some of it is published, some is on its way, and some is research. It lives here so it can be found — the practice itself is infrastructure, and that is what the rest of this site is about.
Every status below is the real one. When something ships, the badge changes.
Endpoint detection with 1,232 Sigma rules, five live threat-intel feeds, a mail gateway, and response actions behind an approval gate. It runs on my own fleet. The source, the install notes and a plain list of what does not yet work are on the project page.
One Go agent for Linux, macOS and Windows: patching, inventory, alerting, click-to-SSH with host-key pinning, and remote desktop. Same codebase and same agent as the EDR — details and download.
A mail gateway needs an MX record, which a personal Gmail or Outlook account cannot give it. The next piece reads the mailbox directly, checks what has already arrived, and quarantines into a folder — so a sole trader on a free account gets the same protection as a company behind a gateway.
The code is mine end to end, and publishing it seemed more useful than keeping it. It also means anyone can read exactly what the agent does on their machine before they run it, which matters more for security tooling than for most software. The work I am paid for is designing, building and running infrastructure; the code is a by-product of that.
The platform stands on other people's work and says so. Detection rules come from the SigmaHQ community under the Detection Rule License; remote desktop is MeshCentral under Apache-2.0; on-access scanning is ClamAV. Every archive ships a NOTICE file naming them. Bugs found on my own fleet are fixed and ship in the next release, and the archive carries a status document that lists the gaps first, not last.
The next releases are aimed at signed, reproducible builds; a Windows Server profile that coexists with Defender rather than fighting it; self-serve enrolment on the hosted instance; and the mailbox-side email security above.
The questions I am working on when there is no client on the clock.
A current MacBook Pro with 36 GB of unified memory runs a 35-billion-parameter mixture-of-experts model at conversational speed, entirely offline. For a small business that means capable private AI on a machine that already exists, with no server room and no subscription. I am working out where that holds up and where it does not.
A GPU server on my own network serves open-weight 7B–14B models to the LLM Chat demo and the ERP assistant. The interesting problems are small ones: one request at a time beats parallel on a modest card; retrieval over a company's own documents matters more than model size; and an agent that can act needs a sandbox, not trust.
Behavioural detection that needs no prior signature — process lineage, credential access, mass-encryption patterns — and the automation that contains a host in seconds. Blocking at the moment of execution is the obvious next step, and in my testing it deadlocks the host; finding a safe way to do it is an open problem.
Taking SPF, DKIM and DMARC to enforcement for businesses that have never looked at them, and what real protection looks like for mail that never passes through a gateway at all.
If you have one of those — email, a server, a network, a system your staff fight with every day — an hour of my time costs nothing, and the write-up is yours either way.