I won’t tell you
you’re safe.
I’ll tell you where you stand — exactly — and what it takes to stand firmer.
Serhii Budiak
I’m Serhii Budiak, an independent security architect. Fixed-fee audits, fractional CISO, and second opinions for teams that have to pass a real one. And I build the tools I recommend — not slideware.
get in touch
Two sentences about where you’re stuck is enough. A person reads it, a person answers — usually the same day.
/ On the record
Where I’ve stood.
Eight years holding a capital city’s network together — through blackouts, annexation, and a war that ran no change windows.
Architected a health-tech startup’s platform to clear the security bar of two top-five US hospital networks — its own customers, doing the auditing. Passed every review.
Designed a geo-distributed architecture split across multiple data centres — built to keep a national system standing when a single site doesn’t.
Helped rebuild the internal IT of a tier-1 carrier and took it through an ISO 27001 audit — on the operator side, not the paperwork side.
/ The workbench
I ship the tools, not just the advice.
Products I run in the open, on my own infrastructure. The clearest way to judge how someone thinks about security is to look at what they leave running unattended.
- shadowatlas FortiGate policy intelligence. Read-only, deterministic — no writes to your firewall. →
- ofn Pan-Canadian OSINT for defenders. Free, passive-only. No contract, no upsell. →
- umbra Email triage for operators. Deterministic scoring, privacy pipeline, self-hostable. →
- iitcon The vetted bench behind me — runs 24/7/365 when a job needs round-the-clock hands. I stay selective. →
/ Who I work with
Where I’m the right call.
HIPAA, HITRUST, or SOC 2 — with a customer or an auditor already waiting on it.
Networks that grew flat over the years and now have to be defensible.
A company that needs a CISO’s judgment and signature, not a CISO’s salary.
And a few I turn down on purpose — box-ticking policies, help-desk-humiliating phishing drills, vendor commissions, softened findings. The full list is on the services page →