Skip to content
[geearr]

guest@geearr:~$ whoami && id && cat ~/.plan

George Rios — the human behind geearr

George Rios (“geearr”, from his initials G.R.) is a hands-on security engineer and fractional CTO with 25 years of experience shipping enterprise systems — most recently Tech Lead and interim CTO at Catch Health, a health-insurance marketplace serving 400K+ members. He builds security products (identity, communication provenance, consent and tamper-evident audit) and tests other people’s systems the way an attacker would: read the code, exercise the system, prove the impact, and help fix what matters.

uid=1000(george) gid=1000(sec) groups=pentest,appsec,email,cloud,ai,cto
01

Experience

  • ▸ 25 years designing, shipping and operating enterprise systems in banks & credit unions, insurance, healthcare, fintech, saas, logistics.
  • ▸ Most recently Tech Lead and interim CTO at Catch Health, a health-insurance marketplace serving 400K+ members.
  • ▸ Fractional CTO through George Rios Consulting LLC: legacy modernization, regulated-data workflows, and auditing AI-built applications.
  • ▸ Builder of security products in identity, communication provenance, consent and tamper-evident audit (below).
02

What geearr does

  • Penetration Testing — manual web, API, perimeter & cloud pentests — every finding reproduced, fixed, retested
  • Application Security — secure code review, threat modeling, OAuth/OIDC review & CI/CD guardrails
  • Email Security — SPF · DKIM · DMARC to p=reject, MTA-STS, BIMI, BEC & phishing defense
  • Cloud Security — AWS · Azure · GCP · Cloudflare — IAM escalation paths, exposure & detection
  • AI & Vibe-Coded App Security — audits for vibe-coded apps & LLM agents — secrets, RLS, prompt injection
03

Security products built

  • Fromenance (email security · anti-phishing) — Communication provenance for banks, credit unions, insurers and utilities.
  • Engrave (audit integrity · ai agents) — The black box recorder for AI agents.
  • Identizen (identity · passwordless) — Accountless identity.
  • AuthnzNet (identity · dev tooling) — OAuth 2.0 + OIDC server in three commands.
  • PRYVC (privacy · consent) — OAuth for contact details.
04

How I work

  1. 01scope — Free 30-minute call: targets, rules of engagement, and what “done” looks like. Clear scope and quote up front.
  2. 02recon — Map the real attack surface — code, endpoints, identities, cloud accounts, mail flows — including what nobody documented.
  3. 03exploit — Hands-on testing that chains weaknesses into proven impact. Safe, controlled, coordinated with your team.
  4. 04report — Findings with evidence, severity and fixes. Written for engineers, summarized for leadership and auditors.
  5. 05retest — Patches written or reviewed with your team. Every fixed finding is retested and confirmed closed.
05

Elsewhere

guest@geearr:~$ cat ~/.links

>>

Contact

guest@geearr:~$ finger george@geearr.com

┤ finger ├
Login:
george
Name:
George Rios
Office:
United States · remote
Shell:
/bin/zsh
Mail:
george@georgerios.com
Book:
cal.com/georgerios/30min
LinkedIn:
linkedin.georgerios.com
X:
@riosgeorge
GitHub:
github.com/noundry

Plan:

Find it before someone else does.

Tell me what you ship and what keeps you up at night. A free 30-minute scoping call gets you a clear plan and quote before any testing begins — whether or not we work together.

./book --scoping-call --freemail -s "engagement" george@georgerios.com

found a bug in this site? security.txt

NORMAL~/.planTop