Offensive and defensive security for the systems you run.

We test, harden, and audit infrastructure, take apart malware, build security tooling, and run red and blue team engagements. You work directly with the people doing the testing, from scoping to retest.

Talk to the TeamRead Our Work
carpathian.ai / security / red vs blue
red teamblue team sweepcontained

What we do

Six services, each scoped to your environment and run by the same small team.

Penetration Testing

We attack your web applications, APIs, networks, and cloud accounts the way an intruder would, then hand you each finding with the steps to reproduce it and the fix.

Infrastructure Hardening

We lock down servers, networks, identity, and cloud configuration against the attacks your environment is most likely to see, and document every change we make.

Infrastructure Audit

A review of what you run today against established security benchmarks, with a ranked list of what to fix first and why it matters.

Malware Reverse Engineering

We take apart samples found on your systems to learn what they do, how they got in, and what to search for across the rest of your environment.

Capability Development

Custom security tooling for authorized offensive and defensive work, built to your requirements and handed over with the source.

Red and Blue Team

Red team engagements emulate a determined adversary against your people, process, and technology. Blue team work builds and tunes the detection and response that catches one.

Start an Engagement

Who does the work

Our founder serves as a Cyber Warfare Officer in the U.S. Army. Our Director of Cybersecurity and Risk has spent more than a decade building vulnerability management programs and responding to incidents.

We keep the team small on purpose. The people who scope your engagement are the people who run it and write the report, so nothing gets lost between a sales call and the testers.

  • Led by our founder, who serves as a Cyber Warfare Officer in the U.S. Army
  • Our Director of Cybersecurity and Risk holds the CISSP and CEH
  • More than a decade of vulnerability management and incident response on the team
carpathian.ai / security / audit
  • Scope
    We agree in writing on which systems are in bounds, the testing window, and the rules of engagement before anything starts
  • Test
    The work runs inside that scope, and you hear from us right away if we find something that cannot wait for the report
  • Report
    Every finding comes with the steps to reproduce it, its severity, and the fix, ranked so your team knows where to start
  • Retest
    Once the fixes are in, we test them again and confirm each finding is closed

Meet the team

Samuel Malkasian, FounderLevi Horsley, Director of Cybersecurity and Risk

See what we publish

We publish the scanner IP addresses and probe paths we block on our own infrastructure, free and rebuilt hourly, and we run a coordinated disclosure program for anyone who finds a flaw in ours.

Threat Intelligence FeedsDisclosure Program
carpathian.ai / security / probes

Common questions

What teams ask before they bring us in.

Who does the security work?
Our founder, who serves as a Cyber Warfare Officer in the U.S. Army, and our Director of Cybersecurity and Risk, who holds the CISSP and CEH and has spent more than a decade on vulnerability management and incident response. The people who scope your engagement are the people who run it.
When does testing start?
After the scope and rules of engagement are agreed in writing. That covers which systems are in bounds, which are not, the testing window, and who to call if something needs to stop.
What do we get at the end?
A written report with every finding, the steps to reproduce it, how severe it is, and how to fix it, ranked so you know what to do first. We walk your team through it and retest the fixes.
Can you work on systems you do not host?
Yes. Most security engagements cover infrastructure the client runs on their own hardware or in their own cloud account. You do not need to be a Carpathian Cloud customer.
Do you take on malware samples from an active incident?
Yes. Send us what you have and we will tell you what it does, how it likely got in, and what to look for on the rest of your systems.

Tell us what you need tested.

A short call is enough to scope the work and tell you what it takes.

Talk to the TeamRead Our Work
Cybersecurity Services | Carpathian