About us — AppSec for regulated sectors

What we do

CyberForge works on the security of the process in which software is made. We work where the code is actually made: at feature design, change review, build and release.

We specialise in technology companies and regulated sectors: banks, fintechs, software houses and software vendors. One thing connects them — they have to deliver fast while proving to a client or a regulator that they do it safely.

We do three things: we train teams, measure process maturity, and implement security practices. We start where there is a real problem — sometimes with a single workshop, sometimes straight with an implementation.

People behind the brand

CyberForge is built by two founders who are responsible for its direction, the standard of work, and what ultimately reaches the client.

Co-founder

Michał Jaśniewski

Responsible for business development and client relationships. Sets the scope of projects and makes sure they answer a real problem, not what is easier to sell. He leads the first conversation and he stands behind what we promise you.

Business developmentScope and pricingCompliance

LinkedIn →

Co-founder

Szymon Mytych

Responsible for the technical layer and the standard of delivery. Designs secure delivery processes, leads threat modeling and oversees implementations. He decides whether a solution is ready to hand over to the client.

Secure SDLCThreat modelingAutomation

LinkedIn →

Four pillars of our work

We base every project on these — from the first conversation to handing over the finished solution.

First we measure, then we act

We start by checking what your process really looks like — and only then do we know what makes sense. Sometimes it turns out the problem lies somewhere entirely different than you assumed.

We sell only the scope you will use

If after a conversation we conclude that one workshop is enough for you instead of a three-month engagement — we will say so, even though we earn less. Selling you something you won't use is the shortest way to make sure you don't come back.

We implement in your code, not in a slide deck

A consultant's work ends on a slide with a recommendation. Ours ends when the change works in your system and has survived the first weeks of the team's normal work. That is the difference that decides whether next year's audit shows the same gaps again.

Your team keeps its pace

A control that adds fifteen minutes to a build or floods people with false alarms will be switched off within a week — and rightly so. We choose tools and thresholds so the signal is useful. Security developers hate simply does not work.

We work in what
your team already uses

We select and implement security tools for your process — starting with the ones you already have. Everything we implement stays with you and runs in your team's hands.

Build and release

GitHub Actions
GitLab CI
Azure DevOps
Jenkins
Bitbucket Pipelines
Argo CD

Containers and Kubernetes

Kubernetes (k8s)
k3s
AKS · EKS
Rancher
OpenShift
Docker · Helm

Code and dependency analysis

CodeQL
Semgrep
SonarQube
Snyk
Trivy · Grype
Dependency-Track

Security testing

OWASP ZAP
Burp Suite
Nuclei
Schemathesis
DefectDojo

Secrets and access

HashiCorp Vault
AWS Secrets Manager
Azure Key Vault
TruffleHog · Gitleaks
OIDC

Supply chain

CycloneDX · SPDX
Syft
Cosign / Sigstore
SLSA
in-toto

Infrastructure as code

Terraform
Ansible · Pulumi
Checkov
tfsec · Terrascan

Policy and modeling

OPA / Rego
Kyverno
Falco
OWASP Threat Dragon
IriusRisk
STRIDE

Monitoring and observability

Prometheus
Grafana
Loki
OpenTelemetry

Using a tool that is not on this list? We plug into what works for you, instead of replacing everything from scratch. Replacing a tool is the most expensive and least often necessary way to improve security.

A company built around
one problem

What we do

People behind the brand

Four pillars of our work

First we measure, then we act

We sell only the scope you will use

We implement in your code, not in a slide deck

Your team keeps its pace

We work in what
your team already uses

Build and release

Containers and Kubernetes

Code and dependency analysis

Security testing

Secrets and access

Supply chain

Infrastructure as code

Policy and modeling

Monitoring and observability

Let's find where risk
enters your delivery process

What we do

People behind the brand

Four pillars of our work

First we measure, then we act

We sell only the scope you will use

We implement in your code, not in a slide deck

Your team keeps its pace

We work in whatyour team already uses

Build and release

Containers and Kubernetes

Code and dependency analysis

Security testing

Secrets and access

Supply chain

Infrastructure as code

Policy and modeling

Monitoring and observability

Let's find where riskenters your delivery process

We work in what
your team already uses

Let's find where risk
enters your delivery process