“The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts.” - Gene Spafford
I build security tools that actually work end-to-end - scanners that scan, detection systems that detect, attacks that actually break things.
fuzzer - crawls a target, fuzzes every endpoint it finds, flags SQLi/XSS/path traversal, and uses an LLM to cut noise out of the wordlist.
attack-detection-and-response - a SOC platform that catches password spray, impossible travel, and MFA fatigue, then maps the response to MITRE ATT&CK.
ics-attack-detection - simulated a nuclear power plant's control system, launched stealthy false data injection attacks against it, then built and compared three detection methods to catch them.
secure-distributed-system - a cryptographic voting system (ECDSA, RSA-OAEP, Shamir's Secret Sharing) with a full threat model and attack case study.
cybersecurity-data-analysis - CVE risk analysis across UK sectors using CVSS/EPSS scoring, clustering, and co-occurrence analysis.
recon-mapper - maps external attack surface: certificate-transparency subdomains, Nmap service scanning, NVD CVE correlation, and an interactive risk-scored graph.
secure-ai - offense against both generations of ML: poisoning and evasion attacks on a CNN, prompt injection against an LLM.
Plus distributed systems (gRPC/RMI auction platform), applied cryptography, network protocol implementations (P4 NAT/PAT, multithreaded traceroute, web proxy), and a handful of algorithms and database projects.