TigerNDR is the second opinion. A full authorized, non-destructive assessment of your network — the exposure a ransomware crew would reach, surfaced find-and-report by a seasoned operator and never exploited. You get a report your vendor can act on, then a retest that confirms the fixes held. Independent of whoever built it, sold it, or patched it.
The vendor who fixed it shouldn't be the one who grades it
Schools, local governments, churches, and small businesses are among the most targeted organizations in the country — large networks, thousands of endpoints, sensitive data, real regulatory weight, and budgets that cover all of it at once. Most have never had their defenses tested by someone who doesn't also sell them the fix. An assessment from the vendor who built your stack grades its own homework. A real ransomware crew won't be as polite.
You authorize the scope in writing. From my own lab, I run a non-destructive, find-and-report assessment of your network — following the same path a ransomware crew would take, but surfacing and documenting the exposure rather than exploiting it. You get a plain-language report your team or your remediation vendor can act on immediately. Then I come back and run it again to confirm every door is closed.
Every target, technique, and timing window is agreed in writing before anything runs. Out-of-scope systems stay untouched. Scope is yours to set — the list above is the menu, not the mandate.
Emulating an adversary is only useful if you can trust the person doing it. These are the non-negotiables on every engagement.
Independence is the whole product. I don't sell you the fix, and I disclose any referral relationship up front — so the only thing I'm selling is the truth about your network.
Not a 300-page scanner dump. A findings report written for the people who have to fix things — and the follow-up that confirms they worked.
My tooling is developed with Claude under Anthropic's Cybersecurity Verification Program (CVP) — a vetting process that authorizes approved operators for legitimate dual-use security work while keeping prohibited uses blocked. It verifies the context of the work: authorized, defensive adversary emulation, performed with permission.
Every engagement is quoted as one flat figure before work begins — the test and the retest together, no hourly surprises and no annual lock-in. Pricing is set to fit a typical purchase order so your team can buy it the way they buy everything else.
Thousands of student and staff accounts, open-by-design networks, and PII under FERPA. The most-targeted public sector in the country — and the least often tested by someone independent.
Utilities, public safety, finance, and records systems on networks that grew by accretion. Find out what a ransomware crew would reach before they show you for free.
Water, transit, libraries, health districts — lean IT, strict obligations, and a board that needs independent assurance, not a vendor grading its own work.
Had a breach, an audit finding, or a remediation project wrap up? That's exactly when a second opinion matters most. I test whether the fix actually held.
There are two kinds of organizations: those that have been hit, and those that haven't been hit yet. The only question that matters is whether someone friendly finds the open door first — on a weekend, with a report — or someone who leaves a ransom note. I'm the friendly one.Why TigerNDR exists
Tell me about your network and what prompted the interest — a board ask, an audit finding, a vendor you'd like checked, or just the sense that no one independent has ever tested you. I'll follow up to scope it and quote a flat price.
Weekend and after-hours engagements across Georgia. I typically respond within 24 hours.