Cybersecurity · Project Delivery

Security that ships. Programs that land.

Caledon Cyber pairs senior cybersecurity expertise with certified program leadership. We test your defenses, stand up your incident response, and drive your hardest technology programs, including AI adoption, from plan to production. One accountable team, so nothing falls into the gap between finding a problem and fixing it.

CredentialsCISSP · GXPN · GPEN · PMP · SAFe Scrum Master

Fig. 01A finding as it appears in our reports. Illustrative sample, not client data.
Finding 03 Severity: High

Password reset links never expire

Asset
Customer portal
Found by
Manual testing
Maps to
OWASP A07

In plain language

A reset link stays valid indefinitely, so an old email in the wrong inbox still opens the account.

Remediation

  1. Make reset links single-use and expire them within 30 minutes.
  2. Invalidate outstanding links whenever the password changes.

Frameworks We Work To

  • NIST
  • OWASP
  • MITRE ATT&CK
  • SOC 2
  • Agile / PMBOK

01The Practice

Two Disciplines, One Accountable Team

Most firms make you choose between people who understand security and people who can deliver a program. We do both: offensive testing and incident response on the cyber side, program delivery and AI transformation on the delivery side. Built for growth-stage and mid-market teams that need senior expertise without a big-name consultancy or a full-time hire.

01 / Security

Offensive / Penetration Testing

Hands-on, manual penetration testing, not just automated scanning. We probe your web and cloud applications, networks, and infrastructure using recognized methodologies such as OWASP and NIST, then hand you a prioritized, plain-language report with remediation guidance you can act on.

Talk to us about testing

02 / Security

Incident Response

When something goes wrong, we help you contain it, understand it, and recover. We also do readiness work up front (tabletop exercises, response plans) so your team isn't improvising under pressure.

Talk to us about response

03 / Delivery

Program & Project Delivery

Certified project leadership for complex, cross-team initiatives. We plan them, drive them, and keep everyone clearly informed, with disciplined attention to scope and schedule.

Talk to us about a program

04 / Delivery

AI Integration & Transformation

Program leadership for AI adoption: strategy, vendor selection, rollout, and change management. We run it with the same discipline we bring to any program. And because we're also the security team, vendor evaluation includes a real look at data handling and exposure, not just features and cost.

Talk to us about AI adoption

02How It Works

From First Call to Handoff

A senior-led engagement that adapts to your team and your schedule.

  1. Discover & Scope

    We start with a conversation about your goals, environment, and constraints, then define a clear scope, deliverables, and success criteria. No obligation.

  2. Plan

    You get a written plan: approach, milestones, timeline, and how we'll communicate. You'll know exactly what happens and when before any work begins.

  3. Execute

    We do the work (testing, response, or delivery) with regular, plain-language updates. No black boxes, and any change in scope is agreed with you before it's billed.

  4. Deliver & Hand Off

    You receive clear deliverables and a walkthrough, plus the context your team needs to carry the work forward. Optional ongoing support if you want it.

03By the Numbers

A Senior, Certified Team

Real, current credentials, and the senior people who hold them do the work.

5

Industry Certifications

CISSP, GXPN, and GPEN in security; PMP and SAFe Scrum Master in delivery. Current credentials across both disciplines, with full details available on request.

16+

Years in Cybersecurity

Offensive and defensive security, within 30+ years across technology roles and 18+ years of technology leadership.

18+

Years in Project Delivery

Program and project leadership across banking, insurance, software development, UI/UX design, regulatory, real estate, and construction.

04Engagement Models

Ways to Work With Us

Every engagement is scoped to your needs, not sold off the shelf. Engagements usually take one of three shapes.

Model 01

Fixed-Scope Project

Commitment
Defined start and finish
Best for
A specific need with clear deliverables
Includes
A penetration test, an incident response, or a bounded program
Pricing
Scope and price agreed up front
Let's scope it

Model 02

Ongoing Advisory

Commitment
Retainer / fractional
Best for
Senior security or delivery leadership without a full-time hire
Includes
Reviews, guidance, and hands-on help on a recurring basis
Pricing
Written scope and price, approved before work begins
Let's talk

Model 03

Custom Program

Commitment
Multi-workstream
Best for
Larger or cross-discipline initiatives, like an AI transformation or a security program build-out
Includes
Testing, delivery, and advisory under one accountable lead
Pricing
Written scope and price, approved before work begins
Request a Consultation

05Why Caledon Cyber

Why Teams Choose Caledon Cyber

The rare combination of people who understand security and people who deliver.

Two Disciplines, One Team

Security and delivery come from one accountable team, so nothing gets lost between finding a problem and fixing it.

Senior & Certified

You work directly with credentialed practitioners (CISSP, GXPN, GPEN, PMP), not a bench of juniors, and there are no hand-offs to people who weren't in the room.

Right-Sized Engagements

We scope to what you need, with no bloated retainers or surprise invoices. Any change in scope is agreed and priced before it's billed.

Clear, Async-Friendly Communication

Plain-language updates on your schedule. You always know where things stand without sitting in another status meeting.

06Our Approach

The People Doing the Work

Caledon Cyber is led by two senior founders. Our security lead brings 16+ years in cybersecurity, offensive and defensive, within 30+ years across technology roles and 18+ years of technology leadership. Our delivery lead brings 18+ years of program and project leadership spanning banking, insurance, software development, UI/UX design, regulatory, real estate, and construction.

We started this practice to give organizations senior, credentialed help that's usually locked up inside large consultancies: security that's tested and delivery that ships, from the same small team. You work directly with both founders, with no juniors and no hand-offs.

30+ Years in Technology

16+ years in cybersecurity (offensive and defensive) and 18+ years in technology leadership, across the public and private sectors.

CISSP · GXPN · GPEN

Industry-recognized credentials in security architecture, exploit research, and penetration testing.

PMP · SAFe Scrum Master

Certified program leadership that plans and drives complex initiatives with discipline around scope, timeline, and budget.

Driving AI Adoption

18+ years leading programs across banking, insurance, software development, UI/UX design, regulatory, real estate, and construction. Now driving AI integration and transformation from strategy through rollout.

Smart Strategies, Seamless Execution

Tell Us What You're Facing

A security concern, an active incident, or a program that needs to land. General inquiries are answered within one business day, with no obligation.

Start a Conversation

07FAQ

Have Questions?

Everything you need to know about working with Caledon Cyber.

Something not covered here? Ask us directly

We're a boutique practice combining two disciplines: cybersecurity (offensive/penetration testing and incident response) and project delivery (program and project leadership, including AI integration and transformation). You get senior, certified practitioners across both, from one accountable team.

Every engagement is scoped to your needs, so we don't publish fixed packages, but we won't make you spend a call just to learn whether we're in your range. Tell us your rough budget and what you're trying to accomplish, and we'll tell you honestly, up front, whether we're a fit. Most work takes one of three shapes: a fixed-scope project, ongoing advisory on retainer, or a larger custom program. Every engagement gets a written scope and price you approve before any work begins.

Senior-led and async-friendly. We agree a written plan up front, do the work with regular plain-language updates, and hand off clear deliverables with a walkthrough. We work remotely and adapt to your schedule, with no mandatory standing meetings.

Yes. We lead AI integration and transformation programs from strategy and vendor selection through rollout and change management. And because we're also your security team, we evaluate AI tools for data handling and exposure, not just features and cost. We bring the program discipline these initiatives often lack.

Our team holds current, verifiable credentials across both disciplines: CISSP, GXPN, and GPEN in security; PMP and SAFe Scrum Master in delivery. That's backed by 16+ years in cybersecurity and 18+ years of project and program delivery.

Every engagement starts with a mutual NDA. Your data stays encrypted in transit and at rest, in access-controlled environments. We keep only what an engagement requires and delete client data on request.

Send a note through the contact form or by email. We'll set up a short, no-obligation conversation to understand what you need, then follow up with a written scope. No pressure and no commitment to start.

08Get in Touch

Let's Talk About Your Project

Tell us what you're facing, whether it's a security concern, an incident, or a program that needs to land, and we'll follow up to scope it.

Active incident? Say so in your first line and we'll treat it as a priority.

  • Senior-led response
  • General inquiries answered within one business day
  • No obligation