About this project
That's the short version. The longer one: a website is always on and always public, and it quietly tells the outside world how closely the owner is watching the doors. Most owners never notice that signal. Attackers built robots to read it, at scale, all day, for free. So this became a small project to read those same public signals first, and warn the owner before anyone else acts on them.Notice the exposed thing early. Tell the person who can fix it.
The path here
Not a resume, just the honest shape of how we ended up building this.
2010
Two credentials the same year: the degree taught the systems, the CISSP taught the mindset, assume it's already compromised, verify everything, trust nothing by default.
2011
Enterprise scale, for the first time, global systems, real attackers, real budgets, and a whole team whose job was watching the doors. That's where "security is somebody's actual, full-time job" stopped being a textbook idea.
2012 – 2025
A hundred-ish contracts and consulting engagements after that, every one a different business, a different stack, the same pattern: almost nobody outside a company the size of PepsiCo has anyone watching their doors at all. That gap is where this project actually got its start.
Now
We're pointing those same skills, plus the AI tooling nobody had ten years ago, at the businesses that could never afford an enterprise security team. And we explain what we find in plain language on purpose, jargon is what keeps people from asking the one question that actually protects them.
These aren't policies on a wall. They're the habits that decide what this project will and won't do, every single time.
Security gets explained in acronyms because the acronyms make people stop asking questions. We do the opposite. If we can't tell you what's wrong in a sentence you'd repeat to a friend, we don't understand it well enough yet.
Everything we read is already public, the same things your visitors' browsers see every day. We never push on a lock, never poke for a way in, never touch anything. Looking and breaking in are different acts, and we only do the first.
The goal is to notice the exposed thing before someone with bad intentions does, and to quietly tell the one person who can fix it. Being early is the whole point. A warning a week before trouble is worth more than a perfect report after it.
This is a person, not a portal. When something's wrong with a business down the road, that's a neighbor, and it's easier to care, and easier to follow through, when you might run into them at the coffee shop.
Why a picture, not a report
Most owners have never seen their own security drawn out as a single picture. It stays a vague worry, important, never urgent, never done. But the moment you can see where you stand, and watch the line climb after you tighten a couple of things, the worry turns into something you can actually finish.
That's the whole trick. Not a thick document you read once and file away. A clear, honest picture you can read in ten seconds and watch improve.
Security gets better when you can finally see it move. Each step is one small thing tightened, the line just makes the progress impossible to ignore.
Where this actually comes from
Long before any of this was a business, it was a hobby: poking at games, figuring out how they worked, seeing how far curiosity could get you inside a system somebody else built. A lot of that curiosity grew up inside the same sci-fi research-lab worlds a lot of hackers our age did, puzzle boxes, portals, science gone slightly too far. That's genuinely where the instinct to look closely at things came from, and it's why our earlier project name quietly nodded to that world.
But that heritage belongs to the games that inspired it, not to us, so we're moving to a name that's entirely ours:ApeCyber(apecyber.com).
We kept the ape on purpose. Apes protect their pack, they watch the treeline, they notice what's off, and they act on it for the group, not just for themselves. That's the whole job here, just pointed at local businesses instead of a troop: notice the exposed thing, tell the one neighbor who can fix it, and keep showing up.
Same habits, same free-favor-first mindset, same neighbor-not-a-portal approach, just under a name we don't have to borrow.
A law firm, a clinic, a shop, a small software team down the road, the kind of places that hold real trust but don't have a security person on staff. When one of them is quietly exposed, the only decent thing is to notice and say so. This whole project exists for that one quiet moment.
A local project, if any of this resonates,say hello.
"Your website is always on, always public. The way it's run quietly tells the outside world how closely you're watching the doors. Most owners never notice that signal."
A local project
ApeCyber is a local field project about what AI changes for web security, written for the small businesses nearby, not for engineers. There's nothing to sign up for here. If you read something that landed, or you just want to talk it through, I'm around.