About
A specialist practice, deliberately small
InFocus Security is an independent offensive security consultancy. One principal consultant, a narrow set of practice areas, and engagements sized so that every one of them gets real attention.
Who you work with
Ryan Zagrodnik
Ryan is the founder and principal consultant at InFocus Security. He started his career as a Windows systems administrator, earned his CISSP in 2011 and moved into security full time, and holds the OSCP as well. He moved into penetration testing as a consultant in 2018, and that career spans the full arc of the modern attack surface: traditional network and infrastructure work, the move of everything important into web applications and then into cloud platforms, and now the arrival of systems that take instructions from text they do not control.
The current focus is where that last shift creates the most unexamined risk (LLM applications, retrieval pipelines, and agentic systems), without setting aside the network, application, and governance work that still accounts for most real-world compromises. The through-line is unchanged: understand how a system is supposed to work, then find the distance between that and what it can be made to do.
Most clients are small engineering teams shipping quickly, often working toward an enterprise customer's security requirements or their first compliance audit. Those engagements reward judgment about what actually matters, which is the part of this work that does not automate.
How we work
Four principles that shape every engagement
- Specialize, then go deep
- A consultancy that claims every service tends to be average at all of them. We hold a narrow practice, AI systems, applications, and networks, and know those surfaces well enough to find what a broad sweep misses.
- Severity means business impact
- A finding is rated by what it lets an attacker do to your organization, not by a CVSS vector copied out of a scanner. If something is theoretically interesting but practically unreachable, the report says so.
- Write for the person doing the fix
- Remediation guidance names the change to make in your codebase or configuration. A report that recommends 'implement proper input validation' has moved the problem, not solved it.
- Say when something is fine
- Padding a report with low-value findings to justify an invoice wastes your engineering time. If a control is well built, that is worth knowing too, and it goes in writing.
Just as importantly
What we don't do
Some of the clearest signals about a security vendor are in what they decline.
- Reselling tools or taking vendor referral fees. Recommendations are not compensated.
- Running a scanner, reformatting the output, and calling it a penetration test.
- Selling a principal on the call and staffing a junior on the work.
- Quoting a number that changes once the engagement is underway.
Working together
Practical details
- Engagement sizes
- From a focused one-week assessment of a single application through to multi-phase programs across a product and its infrastructure.
- Pricing
- Fixed-price per engagement, agreed before work begins. Retainer arrangements are available for teams needing ongoing advisory access.
- Legal & authorization
- Mutual NDA, a signed scope and authorization letter, and documented rules of engagement before any testing traffic is generated.
- Handling of findings
- Your results are yours. Nothing is published, reused as marketing, or shared with another client, named or anonymized, without written permission.
Get started
Start with a conversation
Tell us what you're building and what is worrying you about it. If we are not the right fit, we will say so and point you somewhere better.
or reach out directly, (608) 520-0719 ryan.zagrodnik@infocus-security.com