Systems with real users, real data and real consequences. An assistant can write a function; it cannot own a platform in production, migrate one without downtime, or sign a review an auditor will hold you to.
We only take complex work.
Code, cloud, cybersecurity, AI and consulting for the systems that cannot afford to be wrong. The work your AI assistant can’t do.
Engineering partner to InsecureWeb and UTMStack.
Refunds paid twice when the bank retriesCritical · race between two services · production only
# production trace, 12:04 UTC07.112 bank refund rf_821307.981 payments paid $1,240.0009.115 bank retry rf_821309.402 payments paid $1,240.00Both repositories pass their tests, linters and AI review. The bug lives between them.
- One idempotency key in both servicesfixed
- 30 days of webhooks replayed0 duplicates
- Ledger matched to the bankto the cent
Complex means at least one of these is true
Real users and real dataIt is in production, or will be, and people depend on it.
It has to stay upAn outage costs money, trust or a licence.
Someone will audit itA regulator, a customer’s security team, or a board.
Failure costs more than the projectIf being wrong is cheap, you do not need us.
Five practices, one team
Everything on this list needs production access, accountability or judgment. If an assistant can do it, it is not here. Tap any item to add it to your brief.
Environments where an outage costs money or a licence. The hard part is not the YAML; it is the rollback that was rehearsed, the restore that was tested, and the person on call who has done it before.
Security engineering on systems that are already running. Hardening without breaking production, monitoring that people watch, and incident response with the authority to act at three in the morning.
AI inside products and security operations where a wrong answer has a cost. Evaluated before launch, guarded in production, auditable afterwards, and hosted where your data is allowed to be.
Senior people who take responsibility for a recommendation. Due diligence before money moves, architecture with a five-year cost, a security programme that reaches audit, advice while the lawyers are already on the call.
What we take on, and what we turn down
Saying no to simple work is what keeps senior people on yours. Every engagement is staffed by engineers who have run systems like it before.
We take on
- Platforms with real users and real data
- Cloud estates that have to stay up
- Security programmes an auditor will read
- AI features that have to be right
- Code review before it ships
- Systems nobody on your team wants to touch
We turn down
- Landing pages and brochure sites
- Template and theme customisation
- Prototypes with no future
- Anything a good AI assistant finishes in an afternoon
How an engagement runs
The same four stages whether we are shipping a platform, moving a cloud estate or standing up a security operation.
Audit
Code review, cloud review, a risk register and a roadmap you own. Usually the first two to three weeks.
Build
Short increments, demoed every sprint, in your repositories, with the tests and pipelines that keep them honest.
Harden
Hardening, identity and access reviews, and monitoring switched on before go-live.
Operate
On-call, patching, cost reviews and the next roadmap, for as long as you want us there.
Engineering partner to
Security companies bring us the parts of their own products that cannot be approximately right.
InsecureWebA platform that searches more than 18 billion breached records in real time, runs autonomous penetration tests against live customer assets, and watches the dark web, lookalike domains and leaked credentials for thousands of domains at once. Every match has to be right, because customers act on it.UTMStackAn open-source SIEM that checks every arriving log against 600+ detection rules, correlates tens of millions of events a day across hundreds of sources, runs automated response and scores nine compliance frameworks, in its cloud or on the customer’s own servers. A slow query here is an incident.
Send what your AI couldn’t finish.
Tell us what you want built, run, defended or decided. We come back with a first call, and a written plan after it.
contact@forgecodestack.com