Impact over volume
Forty criticals and no story is a report nobody acts on. We chain findings into the path an attacker would walk, then price the end of it.
Company
We report impact.
Anyone can hand you a list of criticals. The harder job is telling you which ones can end your quarter, and saying it in a way the rest of the business can act on.
- Founded
- 2022
- Based
- Norfolk, Virginia
- Published
- Advisories and tooling →
01
How we got here
Denver to Norfolk.
2022
Denver
Started as a pentest shop for teams that kept getting handed scanner output and calling it an assessment. First engagements were web apps and internal networks.
2023
Building
Scope widened to the surfaces nobody wanted to quote: source review, network gear, OT, and IoT. We started writing our own tooling when the shelf came up empty, and publishing what we found.
2024
Norfolk
Moved the letterhead to Norfolk, Virginia. Operators are placed by which surface they know best, not by which office they sit in.
Now
Retained work
Most engagements are continuous rather than annual. We build and run our own AI-assisted tooling to cover breadth between manual testing cycles, and every candidate it surfaces is validated by an operator before it reaches a report.
02
Who we work with
Three people read the report. We write for all of them.
One engagement, three very different desks.
01
The CISO
A report that survives a board meeting.
Business consequence in the first paragraph. Packet captures in the appendix.
02
The director of IT
A shorter list.
We name the three items that move your risk and say which ones can wait.
03
The network admin
Something fixable on a Tuesday.
Every finding ships with the host, the path we took, and a fix for your stack.
03
What we hold to
How we run an engagement.
The operators write the report
The person who found it writes it up. Nothing gets handed to a technical writer who was not on the engagement.
No sales layer
You scope with the people who will be testing you. We do not employ anyone whose job is only to sell the work.
We build our own AI
When the shelf comes up empty we write it. Our internal platform runs AI pipelines for discovery, enumeration, exploitation, and validation at scale. The operator decides what you see.
We publish
Advisories, tooling, and writeups in public. Same instinct we bring to your environment.
04
The 3Nails Podcast
Recent guests.
Vincent hosts security and IT leaders on who owns risk, how it gets funded, and how it gets explained upward.
Shane McDaniel
City of Seguin, Texas
Running security for a fast-growing city on a municipal budget, and why noise and relationships buy more coverage than spend.
Alex Ryals
MicroAge
Where a commercial team should start with the NIST Cybersecurity Framework, and where frameworks stop helping.
Curtis L. Blais
CyberDynamX
Who actually owns cyber risk, and why the CISO belongs in the room before the incident.
Work with us
Tell us the surface.
Norfolk, Virginia / sales@3nailsinfosec.com