Representative Experience

What the work
actually looked like.

Four engagement records. Each one states the environment, what triggered the call, what was actually delivered, what changed, and — just as importantly — where our role stopped. No client names. No geography. No dates.

Start a current-state assessment About the practice

CISSPCISMC|CISO

NIST 800-171·DFARS 252.204-7012·CMMC 2.0| also SOC 2 · HIPAA · ISO 27001

Method

How these records are written.

A security firm that publishes careless client detail is telling you exactly how it will handle yours. So the rules here are deliberate, and we would rather explain them than have you assume we simply had nothing to say.

No client is named, and no client logo appears anywhere on this site.
No geography. We are an Austin firm; sector plus size plus region is a name.
No calendar dates, start or end months, or exact engagement windows. General duration or initial-term length may be disclosed when it does not create a meaningful identification risk.
Employee counts are published as bands, never as exact figures.
Where a sector is small enough that the sector alone identifies the organization, the sector is generalized one level.
Where an outcome is a number, the number is real and we can substantiate it in conversation under NDA. Where we cannot substantiate a number, we do not publish one.

The same rules mean no real report can be published, even redacted. So we built a specimen instead: a six-page executive summary of an information security program assessment for a fictitious manufacturer, constructed to show the structure, ratings, and voice of the real deliverable without carrying a byte of client data.

View the specimen report (PDF)

Engagements

Four records.

Every one is an Apogee Defense engagement, led personally. Three of the four are still running on annual renewal — which for a practice this size is the retention number, and the one worth publishing.

Manufacturer, defense industrial base

Ongoing

Fractional CISO · 150–500 employees · NIST SP 800-171 · DFARS 252.204-7012 · CMMC Level 2 · Initial term 12 months, annual renewal since

Trigger: Leadership wanted an independent read on decisions made by the previous fractional CISO, and an answer to whether the program actually in place was adequate for a CMMC Level 2 obligation flowing down from customers and ultimately from the government.
Scope: Took the security leadership seat. Reviewed the entire program — digital and physical — reassessed the managed security provider relationship, and rebuilt the control set around what the obligation genuinely required rather than what had been purchased.
Delivered: System Security Plan. Eligible CMMC POA&M items scheduled for closeout within 180 days, with a separate security-program roadmap extending through 365 days. Risk register. Scoping decisions covering both in-scope and deliberately de-scoped systems. Roadmap. Policy revisions. A managed security provider transition.
Outcome: A physical monitoring program carrying roughly $350,000 in annual cost had been specified and budgeted before we arrived. It was stopped before implementation — the reasoning is set out further down this page. Vendor and program rationalization then covered the cost of the engagement itself, leaving it net-neutral against a security budget of roughly $1.2M. A further reduction of about $20,000 per year has remained in place after the managed security provider transition was completed. The organization subsequently completed a CMMC Level 2 certification assessment conducted by an accredited third-party assessment organization. This engagement is also told as a narrative: read the case study.
Not our role: We did not select final products. Every recommendation was an analysis and an opinion on fit; the purchasing decision stayed with the client. We are not a C3PAO, we performed no part of the certification assessment, and no certification outcome was or could be guaranteed.

Medical practice

Ongoing

Assessment & advisory · Under 50 employees · HIPAA · Cyber insurance requirements · Initial term 9 months, annual renewal since

Trigger: A conversation about cyber insurance surfaced an assumption the principals had never tested — that the managed service provider was, as a matter of course, delivering the security controls the policy required.
Scope: Assessed the environment against the insurance requirements and the practice's HIPAA obligations, then tested the assumption rather than accepting it. The provider turned out to be organized around break/fix and add/remove work, not around resilience, uptime, or protection. Several controls the practice believed were in place — network encryption, endpoint monitoring, data loss prevention, firewall monitoring — were not.
Delivered: Assessment report. POA&M. Policy set. Training program requirements.
Outcome: The practice changed how security was owned rather than buying another tool. Controls were brought to the level the insurance policy and HIPAA due-diligence expectations actually required, and the provider relationship was re-scoped around what was being delivered instead of what was assumed.
Not our role: Scope was deliberately capped at high-level review and structured interrogation of what the provider had implemented. We did not independently validate encryption protocols or perform detailed segmentation testing. After correction, the scope was to trust the provider — that was the agreed boundary, and it is worth stating plainly rather than implying deeper verification than was purchased.

SaaS platform

Completed

Technical assessment · 150–500 employees · SOC 2 · Post-acquisition independence · 14 months, project basis

Trigger: Following an acquisition, the company had to demonstrate that its security posture stood on its own rather than being absorbed into — or excused by — the new parent's.
Scope: Internal and external technical assessment focused on control effectiveness. The question was whether the controls worked, not whether they were documented.
Delivered: Assessment report. Risk register. POA&M recommendations. Boundary map. Recommended policy revisions.
Outcome: The company reworked its internal architecture to current standards and segmented customer systems away from general corporate use, closing a path between the two that had not been treated as a boundary.
Not our role: This was a technical assessment only. We did not review policy. The finding was about what was working, not about what had been written down.

Regulated utility

Ongoing

Network architecture & program · Under 50 employees · NIST SP 800-53 · Initial term 3 months, annual renewal since

Trigger: Engaged to architect a new network configuration for an operation that had outgrown the one it had. Security was not the reason for the call.
Scope: Designing the new configuration meant first establishing what was actually running. That review found endpoint protection absent, and no maintenance program keeping the firewall aligned to NIST SP 800-53 — the control was in place, the process that would have kept it current was not. Neither finding was what we had been hired to look for, and both were reported before the architecture work continued.
Delivered: A new network architecture covering endpoints, remote access, a site fallback internet path, and separation of data and voice traffic. Security policies, including the maintenance process the firewall had been missing. Backup and recovery plans. Advisory input into vendor selection for new internal systems.
Outcome: A vendor requirement calling for specific firewall hardware available from a single manufacturer, plus a dedicated secondary circuit, was closed out with a configuration change on hardware already installed — detailed further down this page. The endpoint gap found during the review was closed inside the build rather than deferred to a later project, and the absent firewall maintenance process was written into policy — a control nobody is responsible for keeping current decays quietly between reviews, and that decay is what the standard is actually guarding against.
Not our role: Vendor selection was advisory. We assessed fit and said so plainly; the purchasing decision stayed with the client. This was architecture and program work using NIST SP 800-53 as the reference standard — not an audit, not a certification, and not a formal control assessment against it.

Counter-evidence

When the answer was “don't.”

Any advisor can list what they sold you. These are three occasions where the recommendation was to spend less, or nothing at all. We publish them because they are the harder thing to prove, and because they describe the judgment you are actually hiring.

01A monitoring deployment that would have widened the compliance boundary

A physical monitoring program was specified, budgeted, and ready to implement when we took the security leadership seat at a defense manufacturer. We stopped it. It was disproportionate to the risk it addressed, it required staff to sit and watch feeds of people entering controlled areas, and it created a problem nobody had priced: the recordings themselves would have captured controlled unclassified information. A system bought to support the CMMC program would have been pulled inside its boundary instead — more scope, more evidence, more cost, permanently. This is the $350,000 in the first record above. One figure, not two.

02A firewall replacement that was a configuration change

A vendor requirement called for specific firewall hardware available only from one manufacturer, plus a dedicated secondary internet circuit of its own, on the argument that the site's fallback link could not serve it. Neither was necessary. The requirement was satisfied with a configuration change on equipment already installed, running over the fallback path the site already had. No new appliance, no second circuit, no recurring line item. This is the regulated utility in the fourth record above.

03An incident response engagement that wasn't an incident

An energy company was convinced someone was inside its network exfiltrating new-hire information, and was preparing to engage incident response. The likelier explanation was that its mail server was answering directory queries for anyone who asked. It was. Closing that stopped the behavior, and the symptom disappeared. The client avoided more than $10,000 in investigation and monitoring, and avoided mobilizing an IR team for what was a configuration defect.

Scope of this page

What these are, and what they are not.

Every record above is an Apogee Defense engagement. Each was led personally — there is no delivery team behind the sales call, because there isn't one.

Career experience predating this firm is described on the About page, where it belongs. It is not presented here as firm experience, and no engagement on this page was performed by anyone else.

Three of these four engagements are still running, each renewed annually after its initial term ended. We publish that rather than a client count because a practice of this size is not selling volume; it is selling whether the people who hired it kept it.

Verification

How to check any of this.

The constraint on this page is confidentiality, not substantiation.

Every figure published here is one we can walk through in a scoping conversation, including the budget reduction, the avoided cost, and what the assessment evidence looked like. Where an engagement can support a reference, we will ask that client directly rather than listing them here and hoping they don't mind.

If you are evaluating us against another firm and need something specific — a redacted deliverable, a walkthrough of how a roadmap was structured, or a conversation about an engagement closest to your own situation — ask on the call. That is a faster path to a real answer than a case study written to be persuasive.

See what this looks like on your environment.

Thirty minutes to determine whether an assessment is the right next move. If it isn't, we'll tell you that on the call.

Start a current-state assessment Call 512-994-4441