The portfolio, declined
One name.
There is a fashion for splitting a security company into a family of brands — a parent, a live sister, a runway of reserved domains and coming-soon badges. The theory is that buyers who would not search for the parent need a brand of their own. We read it the other way: a claim is easiest to trust when it can be checked against every other claim its maker has signed. So everything we ship, ships here, under this name. This page is the directory a brand portfolio would be — with the argument inverted.
The directory
Five surfaces, one status
Matched by function to what a portfolio would split into separate companies. Note the status column: it is the same on every row, and every row is a page you can open now.
The exposure score
/methodology
A 0–100 estate score under a published method — five dimensions, stated weights, versioned in public. The free Readiness Check is the no-account way in.
For · Boards and security leads who need one defensible number
CBOM Export
/cbom
The estate register as a bill of materials: CycloneDX 1.6 and SPDX 3.0.1 from one scan pass, stamped with the method version, carrying our name.
For · GRC teams and the auditors reading their tooling
The public signals
/pulse
Sector Pulse, Exposure Signals, the Deadline Board and the Compatibility Reference — aggregate views over named public sources, refreshed on schedule, free.
For · Anyone who wants the market-wide picture without an account
The verification trail
/attest
Posture Attestations with a public lookup, a rendered specimen, and digests a reader can recompute — verification without asking our permission, and without a ledger.
For · Auditors, regulators and counterparties handed a reference
The disclosure door
/security
Security & Disclosure: security.txt, a PGP key, safe harbor, and a person who reads what arrives. No token, no gamified bounty economy — a straight channel.
For · Researchers who found something and want it fixed
Reserved domains: none · Coming-soon badges: none · Tokens: none
The reasoning
Why we keep it this way
One verification trail
The method version on a CBOM, the digest on an attestation and the clauses on Our Position all cross-reference. Split them across brands and each becomes uncheckable against the others.
One standard of claim
Every page here answers to the same rules — sourced figures, placeholders where facts are missing, no prices, no countdowns. A second brand would be a second place for claims to drift.
One signature
Our Position ends in a signature block that covers everything this name ships. That only means something if everything ships under this name.
The standing version of this stance — with the rest of what we refuse to claim, and the signature block that covers it — lives on Our Position.
Start anywhere — it is all one place
The free Readiness Check needs no account, the signals need no login, and the specimen attestation shows the artefact before any engagement exists. Every door opens onto the same house.