INDEPENDENT SECURITY ADVISORY / BUILT FOR WHAT'S NEXT

Security that holds under scrutiny.

Independent security testing and advisory for technology companies. Get defensible answers for customer reviews, AI applications, critical controls, and security decisions.

Talk through the scope Explore services

START HERE

What brought you to Piton?

Choose a situation to explore guidance for your question, with options to broaden or tighten the focus.

AI needs a closer look

We are launching an AI featureTest prompts, data access and misuse paths before release.AI may expose sensitive dataTrace what users, prompts and retrieval can reveal.An AI agent can take actionsCheck tools, permissions and unintended changes.

Someone needs an answer

A customer review is holding up a dealQuestionnaires, procurement and security evidence.An audit needs proofPolicies, control owners and evidence that a control ran.An insurer or investor is askingA clear account of exposure, priorities and ownership.An acquisition raises security questionsFind the access, evidence and decisions that need an independent look.

Something changed

A release changed the risk pictureTest the paths and controls affected by product change.Cloud access may be exposedFollow credentials, roles and reachable systems.Findings need a second lookSeparate material risk from noise and verify fixes.

The work needs direction

Leadership needs a decisionMake risk, budget and trade-offs understandable.Security has no clear ownerSet priorities and a rhythm for the work.An outside event raises concernFind out whether a new exposure affects your systems.You need to see whether Piton fitsFind the question, scope and next useful step.

CORE CAPABILITIES

The right work at the right moment.

Four focused engagements. Each begins with a business question and ends with an answer the team can use.

Piton is led by a security practitioner with 25 years in information security across telecommunications, e-commerce, and media. The experience behind Piton ↗

Deal unblock

Move security reviews forward.

Clear, defensible answers when a customer questionnaire, SOC 2 request, or evidence review is holding up a deal.

Continuous validation

Know whether controls still hold.

Targeted security testing that follows change, validates important controls, and turns findings into decisions.

AI application security

Test what your AI can reveal or do.

Adversarial testing of AI applications, from prompt injection and data exposure to unsafe tool use and broken guardrails.

Fractional leadership

Give security decisions an owner.

Senior security guidance for strategy, priorities, executive reporting, and control ownership without a full-time hire.

View all services ↗Compare engagements ↗

WHAT THE WORK PRODUCES

See what the work produces.

Explore a sample response, finding, test report, or roadmap. Each example shows the question, the evidence, and the next action.

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

Customer-review response

Turn a broad security claim into a supported answer.

Question or test: Customer asks: “Is privileged production access reviewed regularly?”
Response or finding: Access reviews run quarterly. The latest review covered the production administrator group and recorded owner sign-off. Service identities are tracked separately; their review is still in progress.
Evidence and consequence: A dated access export, review record, approval, and removal ticket support the human-access claim. The service-identity gap is recorded rather than hidden.

Follow-up and reusable answer

Next action: Assign an owner to finish the service-identity review and agree on how to communicate that gap to the customer.
Reusable record: Keep the approved answer with its evidence date, scope, owner, and review date so the next response can be checked before reuse.

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

Validation finding

A revoked service credential still reaches a production API.

Fictional validation report with test, observation, fix, and verification sections. — Fictional document mockupView full size ↗

Question or test: Test: revoke a designated test credential, then repeat its previously permitted API request.
Response or finding: The identity service records the credential as revoked, but the API continues accepting it through a cached authorization result.
Evidence and consequence: The revocation timestamp and repeatable request/response show a gap between the identity state and the API’s enforcement. The report records the tested window and affected endpoint.

Fix and verification plan

Fix: Align API authorization and cache invalidation with credential revocation. Assign the change to the relevant application and identity owners.
Retest: Repeat the same revocation sequence and check the affected API. Confirm revoked access is rejected and an authorized credential still works.

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

AI application test report

A support assistant returns another tenant’s document.

Fictional AI security report describing a cross-tenant retrieval test and retest. — Fictional document mockupView full size ↗

Question or test: Test: use an account in tenant A to request a test document belonging to tenant B through the assistant’s search tool.
Response or finding: The tool returns tenant B’s test document. The application checks login but does not enforce tenant access on the retrieved document.
Evidence and consequence: A signed-in customer could read another customer’s information through the support workflow. The finding records the test identities, retrieval path, and observed boundary failure.

Fix and verification plan

Fix: Enforce authorization on every tool request and returned document using the authenticated user and tenant. Keep that check outside the model.
Retest: Repeat the cross-tenant request with the original account and alternate inputs. Confirm unauthorized content is withheld and permitted searches still work.

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

Leadership roadmap

Give the next quarter three owned security decisions.

Fictional security roadmap with three priorities and accountable owners. — Fictional document mockupView full size ↗

Question or test: Decision: prioritize customer-facing security commitments alongside a growing product team’s existing work.
Response or finding: Start with three priorities: ownership of customer-review evidence, the production-access review, and the AI launch decision. Record an accountable owner and the evidence each decision needs.
Evidence and consequence: The roadmap connects each priority to a business decision, a control owner, and a check-in date. Unresolved assumptions remain visible rather than being presented as completed work.

Ownership and decision rhythm

Action record: For each priority, record the owner, next action, evidence required, dependencies, and the decision date agreed with the team.
Leadership update: Use a regular review to show what changed, what remains blocked, and which decision needs leadership attention. Adjust priorities as the business changes.

01 / SCOPE
Define the question.
Agree on the decision, boundaries, access, and deliverables before testing begins.
02 / TEST
Test the claim.
Check behavior against the controls the business depends on. Explain the limits of the evidence.
03 / ACT
Make the next step clear.
Prioritize the changes, name the owners, and agree on how to verify the fix.

PERSPECTIVES

Ideas grounded in the work.

Explore writing

RESEARCH / 2026

A customer security review needs evidence behind the answer

A practical way to connect customer questionnaire answers to current evidence, named owners, and clearly stated gaps.

Read article

RESEARCH / 2026

Kimi K3 is below the frontier. Open-weight cyber risk is already here.

A joint UK–US evaluation put Kimi K3 well behind closed frontier models on exploit development. That is the wrong number to be reassured by.

Read article

RESEARCH / 2026

Seven lessons from CISA's exposed cloud keys

CISA published a candid account of its own credentials turning up in a public repository. The useful part is not the mistake. It is what made the outcome survivable.

Read article

NEXT STEP

Know what holds.

Bring the stalled review, uncertain control, or security decision. We’ll define the next useful step.

Talk through the scope Prepare a scope brief ↗

Security that holds under scrutiny.

What brought you to Piton?

Move the review forward.

Test what matters now.

Find what the AI workflow can reveal or do.

Give the work a direction.

The right work at the right moment.

Move security reviews forward.

Know whether controls still hold.

Test what your AI can reveal or do.

Give security decisions an owner.

See what the work produces.

Turn a broad security claim into a supported answer.

A revoked service credential still reaches a production API.

A support assistant returns another tenant’s document.

Give the next quarter three owned security decisions.

Define the question.

Test the claim.

Make the next step clear.

Ideas grounded in the work.

A customer security review needs evidence behind the answer

Kimi K3 is below the frontier. Open-weight cyber risk is already here.

Seven lessons from CISA's exposed cloud keys

Know what holds.

Privacy preferences

Question counts