Short pieces on what we are seeing in engagements, and occasional company news. We publish when there is something worth saying.
Why your annual pentest keeps finding the same three things
A black-box test with a week of effort and no source finds what a week of effort and no source can find: missing headers, a verbose error page, an outdated library. The same report every year is not evidence that you are secure. It is evidence that the test is shallow. A grey-box engagement, with source, architecture and a working account in hand, spends that week on authorization logic, multi-tenant boundaries and the business workflows an attacker actually cares about. The findings are fewer, harder, and the kind that change the roadmap.
SOC 2 as an engineering problem
Most SOC 2 programs fail the same way: controls are written in a policy document, evidence is screenshotted once a quarter, and reality drifts between. We treat controls as code. Access reviews are generated from the identity provider. Change management evidence is the pull request. Vulnerability SLAs are enforced in CI. The audit becomes a report of what the system already does, and the engineering team never learns the word "screenshot".
Grey Ferrite takes the second floor
We have expanded into the second floor of our North Loop building, adding a secure delivery lab, two more workshop rooms and desks for the next fifteen hires. The lab is a segmented environment, run by our systems engineering function, for engagements that require isolated workstations and networks. Hiring is open across all four practices.
A threat model that nobody updates is a drawing
The threat model from the kickoff workshop is the least accurate one you will ever have. The system changes; the model has to change with it. We keep ours in the repository next to the code, review it at every milestone, and link findings back to the boundary they crossed. When an auditor asks how security was considered in design, the answer is a commit history, not a memory.
SOC 2 Type II report renewed with no exceptions
Our seventh consecutive SOC 2 Type II report covers the security, availability and confidentiality criteria across the full twelve-month period with no exceptions noted. The report is available to clients and prospective clients under NDA. Thanks are due to our systems engineering function, which runs the controls the report describes.
Practice Fridays, two years in
Every other Friday afternoon, the firm stops client work and attacks its own. Two years in, the sessions have produced our internal secure-coding guide, three open-source tools, and a habit: engineers now bring designs to the room before they are finished, because being broken by a colleague is cheaper than being broken by anyone else.
