Building the
Future of Tech

We were running on the assumption that no news was good news. Turned out we'd had exposed credentials floating around for months. Nobody had been looking.

The scanner report we'd been relying on had eleven pages of findings. Theirs had four, and every single one was real and exploitable.

Rules of engagement were agreed in writing before anyone touched anything. As the person who'd have been accountable if it went wrong, that mattered.

Three months in, rankings started moving. Six months in, the traffic showed up. They told us that timeline upfront and it played out almost exactly.

Someone set up a fake profile using our branding and started messaging our customers. It was gone in under a day.

MVP in about nine weeks, which let us get in front of users while the idea was still worth testing.

Site loads fast on a bad phone connection, which is where most of our customers actually are.

The phishing simulation was humbling. About a third of the team clicked. Six months later we ran it again and it was down to almost nothing — the training actually stuck.

Retest was included, which meant we actually fixed things instead of filing the report and moving on.

They got from a phishing email to domain admin in under a day. Watching that walkthrough changed how our leadership thinks about security spend.

First thing they did was a technical audit, and half our site wasn't being indexed properly. No amount of content would have fixed that.

We were running on the assumption that no news was good news. Turned out we'd had exposed credentials floating around for months. Nobody had been looking.

The scanner report we'd been relying on had eleven pages of findings. Theirs had four, and every single one was real and exploitable.

Rules of engagement were agreed in writing before anyone touched anything. As the person who'd have been accountable if it went wrong, that mattered.

Three months in, rankings started moving. Six months in, the traffic showed up. They told us that timeline upfront and it played out almost exactly.

Someone set up a fake profile using our branding and started messaging our customers. It was gone in under a day.

MVP in about nine weeks, which let us get in front of users while the idea was still worth testing.

Site loads fast on a bad phone connection, which is where most of our customers actually are.

The phishing simulation was humbling. About a third of the team clicked. Six months later we ran it again and it was down to almost nothing — the training actually stuck.

Retest was included, which meant we actually fixed things instead of filing the report and moving on.

They got from a phishing email to domain admin in under a day. Watching that walkthrough changed how our leadership thinks about security spend.

First thing they did was a technical audit, and half our site wasn't being indexed properly. No amount of content would have fixed that.

We were running on the assumption that no news was good news. Turned out we'd had exposed credentials floating around for months. Nobody had been looking.

The scanner report we'd been relying on had eleven pages of findings. Theirs had four, and every single one was real and exploitable.

Rules of engagement were agreed in writing before anyone touched anything. As the person who'd have been accountable if it went wrong, that mattered.

Three months in, rankings started moving. Six months in, the traffic showed up. They told us that timeline upfront and it played out almost exactly.

Someone set up a fake profile using our branding and started messaging our customers. It was gone in under a day.

MVP in about nine weeks, which let us get in front of users while the idea was still worth testing.

Site loads fast on a bad phone connection, which is where most of our customers actually are.

The phishing simulation was humbling. About a third of the team clicked. Six months later we ran it again and it was down to almost nothing — the training actually stuck.

Retest was included, which meant we actually fixed things instead of filing the report and moving on.

They got from a phishing email to domain admin in under a day. Watching that walkthrough changed how our leadership thinks about security spend.

First thing they did was a technical audit, and half our site wasn't being indexed properly. No amount of content would have fixed that.

We were running on the assumption that no news was good news. Turned out we'd had exposed credentials floating around for months. Nobody had been looking.

The scanner report we'd been relying on had eleven pages of findings. Theirs had four, and every single one was real and exploitable.

Rules of engagement were agreed in writing before anyone touched anything. As the person who'd have been accountable if it went wrong, that mattered.

Three months in, rankings started moving. Six months in, the traffic showed up. They told us that timeline upfront and it played out almost exactly.

Someone set up a fake profile using our branding and started messaging our customers. It was gone in under a day.

MVP in about nine weeks, which let us get in front of users while the idea was still worth testing.

Site loads fast on a bad phone connection, which is where most of our customers actually are.

The phishing simulation was humbling. About a third of the team clicked. Six months later we ran it again and it was down to almost nothing — the training actually stuck.

Retest was included, which meant we actually fixed things instead of filing the report and moving on.

They got from a phishing email to domain admin in under a day. Watching that walkthrough changed how our leadership thinks about security spend.

First thing they did was a technical audit, and half our site wasn't being indexed properly. No amount of content would have fixed that.