Hi, I'm Bogdan.

Problem

German small businesses now carry a legal duty most of them cannot see. A missing Impressum, a cookie banner without an equal "Reject" button, images with no alt text — each is a concrete violation with a price tag, and an Abmahnung arrives with certainty. "Someone might breach me" is vague; "I am breaking §25 TDDDG right now" is a letter in the post.

Approach

CodeArgus scans a website for everything the law requires to be there — Impressum, Datenschutzerklärung, an equal-weight cookie banner, accessibility — and for the security gaps the owner cannot see, with the legal basis attached to every finding. The scoring is deliberate: the worst finding dominates, any HIGH-severity issue caps the grade at C, and an absence-finding is never auto-marked "confirmed" — because one false CRITICAL in a paid report kills trust for good. The dated, archived report becomes a Nachweis under Art. 32 DSGVO in its own right.

Result

• —A field study across 24 real Oldenburg small-business sites (Aug 2026) grounds the product in observed demand, not a hypothesis.
• —284 automated tests, ruff clean; scoring calibrated by consequence to the client, not by raw rule count.
• —Passive-only checks with legal citations — never an unauthorised active scan of a third party (§202c StGB).

Problem

Every company is shipping an LLM feature. Almost none of them test it the way they test a login form. A chatbot with tool access is a new, wide-open attack surface — prompt injection, system-prompt extraction, jailbreaks, data leakage — and from 02.08.2026 the EU AI Act (Art. 50) requires a bot to disclose that it is AI. A bot you can talk out of that disclosure does not meet the requirement.

Approach

LLMantis is a black-box red-team harness. It fires a library of documented attacks across five OWASP LLM categories at any HTTP endpoint, then scores the responses in two layers. First a deterministic canary — a unique string planted in the target's system prompt; if it returns verbatim, that is a string match, not an opinion (confidence: confirmed). Then an EU-hosted judge model (Mistral) only for the semantic cases string-matching cannot catch. The rules follow: no evidence quote, no finding; only a confirmed finding can drop the grade to F; an incomplete scan gets no grade at all — a letter built on partial data would mislead, and the report is sold as proof.

Result

• —A reproducible suite — every finding ships with the exact prompt that triggered it.
• —EU-only stack: the judge reads customers' system prompts and full transcripts, so a US provider would contradict the product.
• —Runs headless in CI, so a regression in a system prompt fails the build like any other broken test.

Problem

Home and small-office networks now carry the same risk profile as a small company — smart TVs, cameras, printers, an old NAS with a forgotten admin panel — with none of the tooling. Enterprise scanners are priced and designed for people who already know what a CVE is.

Approach

NetzSchild wraps Nmap in a FastAPI service with a browser dashboard anyone can read. It discovers every device on the subnet, fingerprints open ports and services, computes a Risk Score (0–100) and a Time-To-Compromise estimate per device, and translates each finding into plain language with a concrete next step — "Port 23 (Telnet) is open on your router. This sends your password unencrypted. Disable it here." It runs fully locally: no data leaves the network, IP/MAC can be anonymised, and no passwords are stored.

Result

• —Explainable Risk Score (0–100) and a Time-To-Compromise estimate for every device found.
• —Plain-language finding plus one concrete action each — written for someone who has never heard of a CVE.
• —Fully local by design — nothing is sent to a cloud; runs on any Docker host, including a Raspberry Pi.

Problem

Phishing remains the entry point for the majority of real breaches, and the standard corporate answer — a yearly slide deck nobody remembers — measures attendance instead of behaviour.

Approach

A controlled, end-to-end phishing simulation plus the workshop that follows it. I built the campaign infrastructure — a self-hosted registration app (FastAPI, double opt-in consent), tracked mail flow, and per-user metrics — and designed two campaigns (a look-alike museum invitation and a parcel-delivery lure) at escalating difficulty. Clicks and submissions are captured as anonymised, aggregated metrics, never as blame. The debrief then walks participants through their own results: this is the header that gave it away, this is the domain trick that fooled you, this is the four-second check before you click.

Result

• —Two designed campaigns (look-alike domain + known-brand lure) mapped to MITRE ATT&CK T1566.
• —Reusable material pack: registration app, run-book, slide deck (UA/DE/EN), debrief, and reporting workflow.
• —Consent-first by construction — double opt-in at registration, PII minimised and deleted within four weeks.