Overview/Credentials

Held by the people doing the work.

Practitioner record
Company certifications: none held
Client references: none published

A security firm's credibility usually rests on logos. We have none to show, and we will not invent them. What we can put on the record is the practitioner history behind the register: the certifications held, and the roles the people carrying this work have actually done.

That record matters for a specific reason. The board is being asked to trust a plan, and the plan is only worth what the hands behind it can execute. These are the hands.

Exhibit B1 Certifications and qualifications

Individual

Credentials relevant to the testing, governance and sector work in the register.
Credential	Issued by	What it covers
OSWP	Offensive Security	Wireless attack and defence. The base layer of an offensive practice.
OSCP	Offensive Security	Hands-on penetration testing. Exploit work that has to hold up under scrutiny.
OSAI	Offensive Security	AI security. The credential that maps to the testing and agentic work in this register.
Master's	Healthcare IT	Postgraduate qualification in healthcare information technology, the sector where much AI risk work is now most acute.

Held by named practitioners of the firm.

Exhibit B2 Prior roles

Individual

The operating and executive record behind the advisory work.
Role	Domain	Why it shows up in the work
CTO	Healthcare industry	Carried executive responsibility for technology and its risk in a regulated sector.
Information security consultant	Advisory practice	Delivered security assessment and advisory work to client organisations.
Penetration tester	Application and infrastructure	Tested live systems under contract, with findings that had to survive scrutiny.
Database administrator	Data platform	Held custody of production data and its access model.
IT manager	Operations	Ran the operating environment that controls have to work inside.
IT director	Leadership	Owned technology decisions and their budget at director level.
Coder	Software development	Built software, which is why the engineering services are not theoretical.

Roles held before Kulutchka, stated as given.

Statement What this page does not claim

These credentials are held by individuals. They are not corporate certifications, and we do not present them as though the firm holds an accreditation it does not. Where a control framework or standard appears in the register — ISO/IEC 42001, the NIST AI Risk Management Framework, the EU AI Act — it appears as work we can perform, not as an award we display.

We also publish no client names, no engagement counts, no benchmark statistics and no testimonials. If you need references, ask at the briefing and we will discuss what can be shared under confidence. If we cannot share it, we will say so rather than dress it up.

Prepared by

Reviewed by

Approved by

Availability

We are not accepting new clients at present. The register of services stays published, and it is written to be acted on without us.

Read the availability note