The Problem

E-commerce platforms are a high-value target for automated abuse, and most of it is invisible at first glance. Bots mimicking legitimate user behavior inflate traffic metrics, drain advertising budgets, hoard inventory, and stuff credential databases, all while flying under the radar of conventional monitoring. CHEQ needed a rigorous behavioral analysis of their session data to answer a question that's harder than it sounds: which of these 126,959 sessions are actually human?

What’s Included

• Behavioral signal analysis across 126,959 e-commerce sessions to identify automated bot traffic
• Multi-signal correlation including datacenter ASNs, headless browser indicators, timezone mismatches, and interaction speed analysis
• Bot-driven attack pattern detection targeting checkout, login, and product endpoints
• Ad fraud quantification across paid Google and Bing search traffic consumed by automated sessions
• Prioritized mitigation strategy covering ASN blocking, device fingerprint detection, rate limiting, and MFA enforcement

Impact

The Problem

Textbook security knowledge only goes so far. CTF challenges force you to think like an attacker: working backwards from a compiled binary, a memory dump, or a broken web application to understand exactly how and why something is exploitable. The goal here wasn't just to capture flags; it was to build the kind of adversarial reasoning that translates directly into better defensive and remediation work in enterprise environments.

What’s Included

• Reverse engineering of 20+ malware samples to identify threat actor TTPs and attack chains
• Root cause analysis across 20+ security vulnerabilities spanning memory corruption and application security
• Binary analysis using Binary Ninja to deconstruct unknown executables and identify exploitation paths
• Web application vulnerability assessment with documented findings and remediation recommendations
• Findings translated into formats suitable for both technical teams and senior leadership

Impact

The Problem

NBN Corporation's infrastructure had never been put under adversarial pressure. Without a comprehensive penetration test, the organization had assumptions, not a reliable picture of its actual attack surface. The goal was to find out what a real attacker would find, score the severity of every finding objectively, and hand back a remediation roadmap that was actionable rather than just alarming.

What’s Included

• Comprehensive penetration test across NBN Corporation's web applications and server infrastructure
• Identification of critical vulnerabilities including XSS, SQL Injection, Local File Inclusion, and unauthorized server access
• NIST CVSS Version 3 scoring for all findings with an average criticality score of 8.86
• Root access achieved across all systems, validating full compromise scenarios
• Prioritized remediation recommendations including input sanitization, system updates, enhanced password policies, and microservice architecture to isolate network assets

Impact

The Problem

When an incident happens, the evidence doesn't wait for you. Files get deleted, logs get overwritten, and attackers obfuscate their tracks. A forensic investigator's job is to reconstruct what happened from whatever survives (email headers, memory artifacts, fragmented file systems, compiled binaries, et cetera) that weren't meant to be read. This project simulated exactly that scenario: starting with 8 compromised system images and working backwards to surface the full attack chain.

What’s Included

• Phishing and BEC attack vector investigation including email header, attachment, and link analysis
• Recovery of deleted and obfuscated evidence across 8 system images including hashes, user accounts, logs, documents, and metadata
• Reverse engineering of 20+ malware samples to identify threat actor TTPs and email-based attack chains
• Threat intelligence correlation across reassembled evidence to identify attack patterns
• Identification of 80+ functions, libraries, and security vulnerabilities through unknown executable analysis
• Forensic image and file system creation and inspection using Procmon and PeStudio

Impact

The Problem

Modern applications don't have a single attack surface — they have many. A web app can be hardened while the API it talks to leaks data. A container can be locked down while the mobile client it serves has unencrypted communications. Application security engineering means understanding the full stack and knowing where each layer breaks down under adversarial pressure. These five projects were designed to build exactly that: comprehensive, layer-by-layer security intuition grounded in real remediation work.

What’s Included

• Identified and remediated 4 critical vulnerabilities (XSS, CSRF, SQL Injection, command injection) in a Django web application
• Implemented automated detection rules and security controls applicable to AI/ML API environments
• Security audit of an Android gift card application
• Fixed Intent vulnerabilities and implemented HTTPS encryption for REST API communications
• Removed privacy-invasive monitoring code
• Secured containerized applications using Kubernetes
• Implemented automated monitoring with Prometheus
• Established security controls applicable to AI/ML model serving environments
• Identified and fixed 6 buffer overflow and memory corruption vulnerabilities in a legacy C application
• Achieved 85%+ code coverage through systematic test case development using AFL++ fuzzer
• Implemented comprehensive API security controls and monitoring solutions
• Established foundation for securing AI model APIs and detecting anomalous usage patterns

Impact

The Problem

Public law infrastructure has a trust problem: when governments publish legal documents online, there's no guarantee that the content hasn't been tampered with by bad actors, accidental overwrites, or repository changes. Open Law Library's TAF (The Archive Framework) adds a Python-based layer over TUF (The Update Framework) to cryptographically authenticate law repositories hosted on GitHub.

The challenge is that engineering and operations teams weren't consistently using the security tooling, and the vulnerability process management lacked the structure needed to catch and remediate issues before they reached production, thus putting the integrity of law served to 40,000+ users at risk.

What’s Included

• Documentation and reporting workflows designed to drive adoption of security tooling across engineering and operations teams
• Operational security tooling maintenance ensuring continuous verification of code commits on public law hosting infrastructure
• Vulnerability triage and remediation tracking aligned to internal SLAs
• Risk assessment reporting built from aggregated vulnerability and system data across application and infrastructure environments

Impact

The Problem

Enterprise infrastructure is only as secure as its weakest component. City National Bank needed adversarial eyes on its systems. Not just automated scans, but human-led penetration testing that could uncover the kinds of vulnerabilities that slip past conventional monitoring. The challenge wasn't just finding issues, it was translating deeply technical findings into risk-based language that both security teams and executive stakeholders could act on, while keeping vulnerability management continuous rather than episodic.

What’s Included

• Adversarial testing and vulnerability assessments across enterprise infrastructure
• Risk-based remediation recommendations translated for both technical and executive audiences
• Vulnerability scanning, detection, and monitoring system operations
• Cross-functional prioritization of vulnerabilities by risk, exploitability, and asset criticality
• Incident response and threat analysis including malware payload analysis and email investigation
• MITRE ATT&CK-aligned TTP identification using Wireshark and supporting security tooling

Impact

The Problem

Managing IT assets, software licensing, and user access across 18 geographically dispersed government career centers is a coordination problem as much as a technical one. Without centralized visibility, hardware went underutilized, licensing costs ballooned, and security and compliance standards were applied inconsistently across locations. There was no single source of truth for asset lifecycle, system usage, or access controls — making risk assessment, remediation, and reporting largely reactive.

What’s Included

• Live dashboards and KPIs for IT asset inventory, system usage, and lifecycle tracking across 18 centers
• In-house systems for software licensing and hardware usage tracking
• End-to-end IT asset lifecycle workflows including provisioning, de-provisioning, and end-of-life management
• User access management and periodic access reviews for OSCAR, RAPIDS, WorkForce WV, DMV, and related applications
• Standard operating procedures and user access documentation
• Automated solutions for process improvement and federal/state compliance
• Technical support and training for staff and management across all regional centers

Impact