I'm Ryan Basden. Empiric Security is my independent practice: red teaming, penetration testing, purple teaming, and security leadership. Confidence in your security posture should come from thorough testing, not marketing buzzwords and empty promises.
// What I do
Real attackers don't follow a checklist. They adapt, persist, and exploit the gaps in your defenses. Everything here simulates genuine adversary behavior, and every engagement is built around your environment and your threat model. One-off and ongoing both welcome.
Full-scope adversary simulation with realistic objectives. Test your people, processes, and technology against the tactics real threat actors use.
Need coverage? From cloud environments to traditional networks and mobile, I'll help you meet your compliance needs and vendor requirements, or just satiate your curiosity with a coverage-focused assessment of your most valuable assets.
Collaborative sessions where offense and defense work side by side. We execute attack techniques together, validate detections in real time, and improve your security posture iteratively.
Plenty of organizations design their security postures "with hackers in mind", but how many of them actually hire hackers to help build them? You deserve a defensive strategy designed by an attacker, not someone who reads about them.
A few hours a month, or a few days a week. Let's find the right fit ↓
// The approach
After over a decade spent defending and attacking enterprises, this is my core conclusion.
Having worked with companies ranging from five ambitious engineers in a cowork space to Fortune 50 giants, I know that the best security posture is demonstrably resilient.
I've made my career at high-performing firms helping people understand the real nature of threats and defend against them with practical measures. Now I'm doing it independently.
Until you've tested it, you don't know what an attacker does after bypassing your EDR software. You don't know how far they can get using a zero-day exploit with no patch against your firewalls.
Every engagement is tailored to your environment, your threat model, and your goals. You won't get a generic report full of scanner output. You'll get clear findings, realistic risk assessments, and practical remediation guidance from someone who understands both sides of the equation.
Let's find out together before the wrong people do.
// The writing
I break into things for a living, and I write about what that teaches me.
A ‘safely’ disclosed WordPress RCE, taken most of the way to a full unauthenticated exploit chain with public research and an LLM, and the rest with a public…
Read on Substack ↗ 2026.08.02Challenge your mental model of how attackers work before it's too late.
Read on Substack ↗ 2026.03.15Your ultimate guide to guaranteeing one of security's most beneficial exercises does nothing for you.
Read on Substack ↗ 2026.03.02Are physical security assessments a fun novelty? Or are fewer businesses taking them as seriously as they should?
Read on Substack ↗ 2026.02.12Despite the millions upon millions of dollars thrown at penetration testing every year, big data breaches are still as common as ever.
Read on Substack ↗// On the record
The launch release. Organizations don't fail at security because they're short on tools, they fail because nobody agrees on what the risk actually is.
Read the release ↗ 2026.01.22 TechBullionA profile on why the industry keeps buying technology and keeps under-investing in the people who have to make the decisions.
Read the article ↗ Webcast Bishop FoxHow purple teaming turns security from a line item leadership resents into something that demonstrably protects revenue.
Watch ↗ Episode 06 Cybersecurity WebGame hacking, how I ended up in offensive security, and what good pentesting and reporting actually looks like.
Watch ↗// Get in touch
Tell me what you're trying to find out and roughly when you need it. That's enough to start. If I'm not the right person for the job, I'll say so and point you at someone who is.
