About Grey Ferrite
A small firm with an unreasonable standard.
Fifty-one people, one North Loop building, engineers in nine states, and fourteen years of building software for people who get audited.
Our story
Started by the people who kept finding the bugs.
Grey Ferrite was founded in 2012 by a small group of application security consultants who were tired of writing the same findings report every year for the same clients. The vulnerabilities were never exotic. They were the predictable result of software built by teams that had never been attacked.
So we started building the software ourselves, with the attackers in the room from the first design review. The first client was a regional bank. The second was a hospital system. Fourteen years later the shape of the work has not changed: build it carefully, break it honestly, run it responsibly, and hand over the evidence.
The name comes from the ferrite bead, the unglamorous grey ring on a cable that quietly keeps interference from becoming a problem. We like the ambition in that.
Principles
Rules we actually follow
- Attack your own work. Nothing ships that one of us has not tried to break.
- Evidence over assurance. If we cannot show it, we do not claim it. That applies to our marketing too.
- Say the hard thing early. Risks go in the weekly status in plain language, the week we see them.
- Your systems, not ours. We leave nothing behind that you have to migrate away from.
- Hire for judgment. Tools change yearly. Knowing what matters does not.
The team
Fifty-one people, by practice
We publish the shape of the firm rather than a wall of headshots. You will meet the people on your engagement before you sign anything.
22Product engineering · software engineers, architects, product designers
9Application security · testers, reviewers, threat modelers, systems engineering
8Platform engineering · cloud, infrastructure, operations, on-call
5Compliance engineering · control design, audit support, policy
4Engagement leads · delivery, estimates, the accountable phone call
3Operations · finance, people, office
Leadership is a managing director, a director of engineering, a director of security and a director of operations. All four still work on engagements.
Where we are
Minneapolis, and wherever the work is.
| Headquarters | North Loop, Minneapolis, Minnesota. Two floors, a secure delivery lab, a very good coffee machine. |
|---|---|
| Distributed | Engineers in nine states, all on company-managed hardware, all under the same controls. |
| On site | Engagement leads travel to clients; delivery teams visit for kickoffs, threat-model workshops and go-lives. |
| Visits | Clients and prospective clients are welcome by appointment. Bring your security questionnaire. |
Timeline
Fourteen years, briefly
- 2012Founded as an application security consultancy by four engineers in a shared office.
- 2014First product engineering engagement, for a regional bank. Security sign-off on every change becomes policy.
- 2017Platform engineering practice formed. First 24×7 operations retainer.
- 2019First SOC 2 Type II report, with the internal controls run by a dedicated systems engineer.
- 2021Compliance engineering practice launched. First FedRAMP Moderate package delivered as a subcontractor.
- 2024Team passes forty. Move into the North Loop building.
- 2026Second floor added; fifty-one people across nine states.
Want to meet the team?
The first call includes the engineering lead who would run your engagement.