About
Most businesses do not have a technology problem. They have an execution problem.
We build the systems that remove it: AI agents, automation, and security, built into how your team already works.
A note from the founder
Critical work is still trapped in inboxes, spreadsheets, legacy software, and the experience of a few people who know how to keep things moving. Quotes wait. Requests get routed manually. Teams spend their best hours chasing information instead of making decisions.
That friction is expensive, but not just because it wastes time. It slows your response, limits your capacity, and makes growth harder than it needs to be.
We build the systems that remove it.
That might mean an AI agent that turns an incoming request into a complete, review-ready quote. It might mean connecting the software your team already uses so work moves without constant follow-up. It might mean identifying and securing the weak point no one has had time to address.
We do not sell discovery for its own sake, or hand over a presentation and leave your team to make it real. We find the work creating the most drag, design the right solution, and build it into the way your business actually operates.
The standard is simple: the result must save meaningful time, reduce operational risk, or create a real advantage over the way you work today.
And you will work directly with me throughout the engagement. I scope the problem, architect the solution, and build the system. No handoffs, no rotating delivery team, and no distance between the person making the promise and the person responsible for delivering it.
Seven years in an enterprise security operations center, from SOC analyst to senior analyst, taught me to trust evidence over opinions and to deliver on the date I promise. I triaged real attacks across the stack, wrote the detections that caught what the tools missed, and owned incidents end to end. You get that discipline, now pointed at building working software: AI engineering, automation, and security, aimed at your team.
Where the discipline comes from
Detection engineering
Custom detections in Microsoft Sentinel (KQL): Azure AD device-registration correlation, an AI and LLM consumption anomaly detector, Snowflake brute-force, and AWS suspicious activity. Response automated with Torq SOAR playbooks.
Incident response
Real intrusions owned end to end, from a live PHP web shell to containing an active account takeover within sixty-four seconds of the first remediation. Several are written up on the InboxWatch blog.
The stack, in production
Cortex XDR, Microsoft Defender, Sentinel, Entra ID, and Intune, plus Proofpoint, Palo Alto, Rapid7, and Critical Start MDR, built on with Python and PowerShell.
Industries worked with
- +Aerospace & Defense
- +Distribution
- +Financial Services
- +Real Estate
Let's talk
Tell me what your team does by hand, or what you want to build.
Or email nicholas@papacorporation.com directly.