Work

Sovereign campaign simulation infrastructure for authorized red teams - multi-host deployment, operator-owned mail, audit trails, and no vendor telemetry.

Local autonomous red-team operations - specialist lanes, shared memory, governed scope, and operator-owned tools.

Mobile red-team operations for authorized Android assessments - stock-device collection, encrypted operator channels, dashboard, and evidence export.

Distributed network intelligence at national scale - regional worker pairs, VPN-isolated egress, MQTT orchestration, and Postgres-backed results.

Local forensic evidence analysis - multilingual audio, vision, entity correlation, identity clusters, and hybrid search.

Android forensics built like a product - selective extraction, native Rust UI, relationship graphs, reports, and SHA-256 integrity.

Visibility from inside the router - remote libpcap for embedded Linux, Zeek alerts, Prometheus metrics, and replayable captures.

Published Qualcomm WLAN research: transient denial-of-service in WLAN host/firmware triggered by malformed authentication-frame behavior.