Security FAQ — pen testing, AppSec, email, cloud & AI app security

George Rios — “geearr”, from his initials G.R. — is a US-based security engineer and fractional CTO with 25 years of experience building enterprise systems in financial services, healthcare, insurance, SaaS and logistics. Through geearr he offers penetration testing, application security, email security, cloud security and AI-application security audits, and he builds security products including Fromenance, Engrave, Identizen, AuthnzNet and PRYVC.

Mostly regulated and high-trust industries: banks and credit unions, insurance, healthcare, fintech, SaaS and logistics. Engagements are often driven by SOC 2, HIPAA, PCI DSS, GLBA or cyber-insurance requirements, and reports are written so they can be shared with auditors and underwriters.

A written report with an executive summary, technical findings with evidence and severity, prioritized remediation guidance, a live readout with your team, and a retest of fixed issues. Where it helps, George also writes patches, configures CI/CD guardrails or applies DNS and cloud changes directly.

Book a free 30-minute scoping call at https://cal.com/georgerios/30min or email george@georgerios.com. You will get a clear scope and quote before any testing begins.

Yes. geearr is US-based and works remotely with teams across the United States and internationally. Testing is performed over the internet or through VPN / Zero Trust access you provision; on-site work can be arranged when required.

A vulnerability scan is automated: it matches software versions and configurations against known issues and produces a long, noisy list. A penetration test is performed by a human who validates findings, chains weaknesses together, tests business logic, and demonstrates real impact. Scans are useful hygiene; a pen test tells you what an attacker could actually do.

Most web application or API penetration tests take one to three weeks of testing depending on the number of user roles, endpoints and integrations in scope, followed by reporting and a readout. A focused external perimeter test can be shorter. Scope and timeline are agreed during a free scoping call.

Yes, when it is scoped properly. Testing follows agreed rules of engagement, avoids destructive payloads and denial-of-service, uses dedicated test accounts, and coordinates timing with your team. A production-equivalent staging environment is an equally valid target.

A secure code review is a manual, line-level examination of the code paths that matter most — authentication, authorization, data access, input handling, cryptography and integrations — supported by static analysis. It finds logic flaws and design mistakes that automated tools cannot, and each finding comes with a concrete fix.

Yes. Unlike report-only firms, George Rios is also a working engineer and fractional CTO, so engagements can include writing the patches, opening pull requests, and pairing with your developers until each issue is closed and verified.

Yes. Identity is a specialty — George built AuthnzNet, an OAuth 2.0 + OIDC server with PKCE and RS256 signing, and Identizen, an accountless OIDC login system. Reviews cover flow selection, PKCE, redirect URI validation, token storage, signing keys, refresh rotation and logout.

SPF lists which servers may send mail for your domain. DKIM cryptographically signs each message so receivers can verify it was not altered. DMARC ties the two to the visible From: address and tells receivers what to do when a message fails — monitor (p=none), send to spam (p=quarantine) or block (p=reject) — while sending you reports on who is mailing as you.

If you want to stop attackers from spoofing your exact domain, yes. A DMARC policy of p=none only monitors; it does not protect anyone. Google, Yahoo and Microsoft already require DMARC for bulk senders, and p=reject is the goal for any domain your customers trust. The safe path is a staged rollout that inventories every legitimate sender first.

DMARC stops exact-domain spoofing, which is a large share of phishing — but not lookalike domains, compromised vendor accounts, or a real employee mailbox being taken over. Effective BEC defense combines DMARC enforcement, lookalike-domain monitoring, mailbox hardening, and out-of-band verification for payment and banking changes.

A cloud security assessment reviews identity and access management, network exposure, data storage, secrets, encryption, logging and incident-detection coverage across your AWS, Azure, GCP or Cloudflare accounts. The goal is to identify realistic attack paths and fix the highest-impact misconfigurations first, not to produce thousands of low-value alerts.

Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP) and Cloudflare — including Workers, Pages, R2, D1, Zero Trust and WAF. Hybrid environments and SaaS platforms such as GitHub, Microsoft 365 and Google Workspace are commonly included in scope.

Not by default. AI coding assistants frequently produce working code with missing authorization checks, secrets embedded in front-end bundles, permissive database rules and outdated or non-existent dependencies. The code may function perfectly while exposing every customer record. An independent security review before launch is strongly recommended.

Prompt injection is an attack where untrusted text — in a web page, email, document or tool result — contains instructions that an LLM follows as if they came from the user or developer. In agents with tool access it can lead to data exfiltration or unauthorized actions. Defenses include least-privilege tools, human confirmation for sensitive actions, output filtering and isolating untrusted content.