Application security engineering
I've spent 29 years building software. That's how I know where the cracks tend to hide.
Building software securely and testing that it holds up are the same job to me. I do both, for apps, APIs, and AI systems.
Jason Gillam
Founder, CISSP
Building software since the Vic-20, breaking it professionally for 16 years. Yes, the Hawaiian shirts are intentional.
- IANS Research Faculty
- ISC2 Charlotte Metro — Board Member
- OWASP Project Committee Member
The market profits from your confusion. I don't.
You've sat through the demos. The dashboards, the slide that just says AI now, the quote that somehow triples by the third call. None of it tells you where your software actually stands. I think you deserve to know, and I think finding out shouldn't require a decoder ring.
29 yrs
building software
16 yrs
breaking it professionally
Hundreds
of SMB pentests
C-suite
security and engineering experience
What I do
Application security engineering
Build it securely
Are we building this the right way?
Application Security Consulting
Architecture and threat modeling, pipeline reviews, code reviews, and help building an application security program. I work alongside your team and give you a practical path that fits the pipeline you actually have.
→ Ways I can helpNeed someone regularly?
Some teams need application security expertise on hand without adding headcount. I take on a small number of ongoing advisory arrangements: design reviews as features get built, pipeline questions as they come up, and a second set of eyes on AI work before it ships.
Test that it holds up
Where is my application exposed?
Application & API Pentesting
Hands-on testing of your web apps and APIs, with findings your developers can act on and a letter of attestation for whoever is asking for proof. Two ways to run it:
Traditional AI-augmented
→ See how I testWe shipped an AI feature. Now what?
AI System Testing
Chatbots, RAG systems, and agents. We start by working out what you actually shipped, then I test what it can be made to say and what it can be made to do.
→ How AI testing worksI price every engagement on the effort the actual work takes, and I'll get you a number before anything starts.
From the lab
The Lab
Where I chase the problems that fascinate me, with no client driving it. Some of it becomes a tool you can use.
Also on the bench: the CSP Index, a scoring model and calculator for Content Security Policies. Paste yours in and see how it grades.
→ See what's cookingWyrmSight watches every third-party script, tracker, and API your web apps actually load, and tells you the day one of them changes.
Apply for beta access →Approach
The Plan
Scope it right
First I get my head around what you've actually built, the app, the API, or the AI system, and what's worth putting under the microscope. That tells me the real level of effort, and I size the scope to fit the work rather than stretching the work to fit a quote.
Test with the lights on
I cover the standards you're expected to meet, OWASP Top 10 and the rest, then keep digging for the flaws you won't find by working down a checklist. And I do it in the open: you'll know when testing starts and stops, if I find something serious, I'll tell you right away rather than waiting for the report, and if you spot anything strange on your network while I'm in there, tell me. It's probably me. But probably isn't certainly, so don't assume.
Stick around after the report lands
Once the report lands, the fixing starts, and I stay part of it. For 90 days, the people doing the fixing can bring me questions, and I'll make sure they can reproduce every issue I found. Once you've patched the high and critical findings, I retest them and reissue the report and attestation, one cleanup pass inside that same window.
So, where does your software actually stand?
If I can help, I'll tell you how. If I can't, I'll tell you that too.
Start the conversation