Services
How can we help?
Three businesses, one subject. Whether you need consulting, investment, or someone who has built this before, the common thread is application security done at a scale that survives contact with real developers.
01
Consulting
We help companies improve their application security posture. This is the work Chris has been doing for twenty-nine years, and it is the reason the rest of this page exists.
- Security champion programs
- Assessing a program that already exists, or designing one that does not. Most champion programs fail the same two ways, and both are visible from the outside.
- AppSec program assessment
- Where the program actually is against where it thinks it is, and a set of recommendations you can act on rather than a maturity score.
- Threat modeling
- Teaching it to the developers who have to do it, not to the architects who will write it up. Chris founded and sold Devici, a threat modeling company, and hosts the podcast the practice argues on.
- AI and application security
- Two separate questions, routinely confused: what changes about your AppSec program when developers are shipping code an assistant wrote, and what it is safe to hand an assistant in the first place. Plus the one nobody asks — whether the AI in the tools you are being sold is doing anything at all.
02
Investment
We cheer for the underdog. We look for a great founding team and an idea that changes something about cybersecurity, and we look for scrappy founders who get things done without much money. We bring capital, expertise, and advice at every step — largely because we remember wanting all three.
03
Incubation
We have started successful companies before and have no intention of stopping. We build from the ground up, and we partner with other founders on new ideas. What we bring is not a playbook so much as having already made most of the mistakes.
Who we serve
Experience at every scale
Chris has led security for user bases from seven people to seventy thousand. The advice changes enormously between those two, and most of what goes wrong in AppSec is advice imported from the wrong end of that range.
- Start-up
- Chris and Deb founded Security Journey in 2016 and bootstrapped it to an exit in 2022.
- Mid-size
- At exit, twenty-seven employees served tens of thousands of monthly users.
- Corporate
- Before Security Journey, Chris was Chief Security Advocate at Cisco — a company of more than seventy thousand people.
Ready to talk?
Consulting, investment, or incubation — tell us where your business actually is and we will tell you honestly whether we are the right people.