Veteran-Owned Security Consultancy

Security Built Where Attackers Actually Look

Not where checklists assume.

ALT builds security the way attackers test it — against reality, not assumptions. We design defenses informed by real adversary tradecraft: the tactics, techniques, and procedures attackers actually use to gain access, move laterally, persist, and extort.

ALT is led by an operator who understands how modern attackers think, where they probe first, and which controls they quietly bypass — because he's seen it firsthand.

Book a Consultation View Services
Michael Valdez - Security Consultant
Background Includes
Intelligence Community Defense Sector Energy & Critical Infrastructure AWS IPO Leadership
Services

End-to-End Security Capabilities

From assessments to architecture, compliance to incident response — I help organizations build and maintain security programs that protect what matters.

Assessment

Rapid Security Health Check

A focused assessment of your security posture with prioritized recommendations you can act on immediately.

  • Cloud infrastructure review (AWS/GCP/Azure)
  • IAM and access control audit
  • Prioritized risk report
  • 90-day remediation roadmap

1 week • Starting at $5,000

Program Build

Compliance & Security Program

Full compliance readiness and security program development — built for your business, not copied from a template.

  • SOC 2 Type I/II readiness and certification
  • ISO 27001 implementation
  • Policy development tailored to your operations
  • Continuous monitoring and evidence collection

3-6 months • Custom scoped

Leadership

Fractional CISO & Advisory

Executive security leadership, strategic planning, and hands-on guidance without the full-time cost.

  • Strategic roadmap and board reporting
  • Vendor risk management
  • Team mentorship and hiring support
  • IPO and M&A security readiness

Monthly retainer • From $4,000/mo

Cloud

Cloud Infrastructure Security

Secure your cloud environment with architecture reviews, hardening, and ongoing monitoring.

  • AWS, GCP, and Azure security architecture
  • Multi-account strategy and guardrails
  • Infrastructure as Code security review
  • Cost optimization with security in mind

Project-based • Custom scoped

Engineering

SecDevOps

Embed security into your development pipeline without slowing down your team.

  • CI/CD pipeline security integration
  • Secure code review and SAST/DAST implementation
  • Container and Kubernetes security
  • Developer security training

Project-based • Custom scoped

Response

Incident Response & Ransomware Readiness

Be ready when it matters. Build your IR capability, test your recovery plans, or get hands-on support during an active incident.

  • Incident response planning and playbooks
  • Ransomware readiness assessments
  • Tabletop exercises and simulations
  • Active incident support and containment

Retainer or project • Custom scoped

AI Risk

AI Security & Governance

Protect your data as your team adopts AI tools. Know what's being shared, by whom, and where it's going.

  • AI usage policy and acceptable use guidelines
  • Data flow mapping for GenAI tools
  • Shadow AI discovery and guardrails
  • Employee training and awareness

Standalone or add-on • Custom scoped

Intelligence

Threat Intelligence & Profiling

Understand who's targeting you and why. Develop strategies based on real threat actors, not hypotheticals.

  • Threat landscape assessment for your industry
  • Attacker profiling and TTP analysis
  • Competitive and due diligence intelligence
  • Executive and VIP threat profiling

Project-based • Custom scoped

Risk

Third-Party & Vendor Risk

Your vendors are part of your attack surface. Know who you're trusting with your data.

  • Vendor risk assessment program design
  • Security questionnaire development
  • Third-party risk registers and tracking
  • Ongoing vendor monitoring strategy

Project-based • Custom scoped

Coming Soon

Security Training & Workshops

Hands-on training courses for security teams, developers, and leadership — built from real-world experience, not textbooks.

  • Security awareness for executives and boards
  • Secure development practices
  • Incident response training
  • Cloud security fundamentals

Contact for details

We Don't Guess How Attacks Happen

We know where they start.

Most security programs focus on what should stop an attack.

We focus on what attackers actually exploit:

  • Identity paths that look "low risk" on paper
  • Over-trusted integrations and automation
  • Misplaced confidence in alerts that never fire in time
  • Recovery gaps exposed only after encryption or extortion

This perspective comes from years of hands-on adversary work and real incident response — not theory.

Proven Under Real Pressure

ALT leadership has assisted in ransomware response and recovery for major oil and energy organizations, where failure isn't measured in dashboards — but in downtime, safety, and national impact.

That experience informs how we design:

  • Detection that matters early
  • Containment that actually works
  • Recovery plans that survive worst-case scenarios
Track Record

Defenses That Hold When Pressure Hits

Across intelligence, defense, and enterprise — consistent outcomes built on understanding how attacks actually unfold.

  • ✓ Dramatically reduced security incidents through detection that catches what matters early
  • ✓ Transformed response times from hours to minutes with containment that actually works
  • ✓ Built and maintained SOC 2 Type II and ISO 27001 on lean teams — without security theater
  • ✓ Led security through IPO — navigating scrutiny that exposes gaps in unprepared programs
  • ✓ Assisted ransomware response for critical infrastructure where recovery plans had to survive worst-case
  • ✓ Designed cloud security architecture that closes the identity and integration paths attackers probe first

Security Built From the Attacker's Tradecraft

So when pressure hits, your defenses hold.

Book a Consultation