38 Years Breaking Things
So You Don't Have To.

Security consulting & product engineering by Kevin Stallard.

ThreatTape is the security consulting and product practice of a 38-year veteran of IBM/ISS, Northrop Grumman/CDC, U.S. Bank, and Microsoft/Activision. We don't just advise — we build production security tools. Then we use that experience to secure yours.

Joint Ventures

Three structured ventures taking ThreatTape platforms to market

Individual Products

Tools and platforms built and operated under Threat Tape LLC

JV — EDD-i, Inc.

EDD-i

Compliance scribe + audit witness for ${'$'}5–50M revenue companies.

Authenticated endpoint scanning (EDGAR), governance posture (CGAP), and continuous compliance evidence captured executive-first — CISO, Legal, CFO, CEO, CTO. EDDi tracks what happened, who saw it, and when; intake + audit, not IR.

  • Compliance scribe + audit witness — intake, track, record (not an IR platform)
  • Multi-tenant Azure deployment (Container Apps + NFS)
  • Belarc + EDGAR field coverage validated end-to-end
  • 50/50 JV with CAT LLC via EDDi Technologies SpA
JV — Constitutional infrastructure

Ostraq

Election security on a NIST 800-53 High baseline.

Shamir threshold keys, Merkle-chained ballot ledger, containerized appliance deployment. The "Constitutional document × cryptographic HSM" platform — gravitas-grade trust for high-stakes elections, including the HOA derivative.

  • Live at ostraq.com, demo.ostraq.com, hoa.ostraq.com
  • FedRAMP-compliant by design
  • Auth: Keycloak per appliance, Entra OIDC for personnel
  • Replaces older VoteSecured architecture (2026 rebrand)
In development

SourceIQ

Content provenance and disinformation analysis. Free for individuals, always.

Paste any social-media URL → full intelligence report. Five parallel analysis engines feed a composite trust score (0–100). STIX-format campaign fingerprinting for analysts; gov + enterprise revenue tiers fund the free consumer tool.

  • Composite trust score (0–100) aggregating all 5 engines
  • 5 engines: provenance, network, semantic, source-graph, deception
  • Trust bands: verified · credible · caution · suspicious · threat
  • Live: sourceiq.info (apex IONOS, app on Azure)
In development

IQualify

The honest alternative to ATS-grift résumé optimization.

Pre-application gap analysis. Structured rejection reasoning. Bias-audit by construction. Three products, one engine — Greenhouse middleware (B2B), Chrome+Firefox extension (consumer), Intelligence Flywheel (v3).

  • 25-entry bias catalog, legal-review gated
  • Append-only prompt versioning + Merkle audit trail
  • Per-employer HMAC scoping — no PII leaves the ATS
  • Sigstore Rekor timestamp anchors keep the audit log tamper-evident
In development

ThreatTape Recon

Automated reconnaissance + OSINT for penetration testers.

Domain enumeration, CVE mapping, executive profiling, TOR-anonymous scanning, professional report generation. The decision engine narrates [AI] reason → action so analysts can audit and override.

  • Three target types: domain · company · person
  • 5 rotating TOR proxies for low-attribution recon
  • Tier 1 PoC + Tier 2 red-team (authorization-gated)
  • Letter of Marque: privateering, sanctioned + logged
In active development

ConManagement

The Core-apps / Eventeny replacement built for Dragon Con-scale conventions.

Multi-tenant SaaS for convention operations — schedule, commerce, mobile, analytics, communications. Volunteer Management as a first-class differentiator (Eventeny's actual gap).

  • Six core services: schedule, commerce, mobile, analytics, comms, volunteers
  • Multi-tenant SaaS — one stack, many cons
  • Targeting Dragon Con-scale conventions first
  • In active development
Playable

Roc

Trick-taking card game inspired by classic Rook.

Highly configurable rules engine supporting dozens of regional house-rule variations. AI opponents at four difficulty levels. Multiplayer over Socket.io. Flutter (iOS / Android / web).

  • Configurable rules engine supports dozens of regional house-rule packs
  • AI opponents — four difficulty levels from novice to expert
  • Multiplayer over Socket.io with persistent sessions
  • Flutter — iOS, Android, web from one codebase
Playable

Drifter: Edge of the Black

Persistent-universe space trading inspired by the BBS-era TradeWars 2002.

Trade commodities, build economic empires, run with a corporation. Persistent universe — your moves matter when you log off.

  • Persistent-universe trading + combat
  • Corporations (guilds) for cooperative play
  • Flutter (iOS, Android, web)
  • Successor in spirit to TradeWars 2002
In development

D20 Craps

Casino craps reimagined with twenty-sided dice.

3D physics demo bridges traditional casino craps with D&D tabletop gaming. Targets both casino operators and tabletop gamers.

  • 3D physics dice — Three.js + Cannon
  • Next.js + TypeScript stack
  • Cross-vertical: casino floor + tabletop session
  • Demo available on request — d20craps.com
In development

Trench Defense

Wave-based trench warfare defense game.

Prepare fortifications, fight off AI attackers, upgrade between waves. A father-son learning project — readable, well-commented code by design.

  • Wave-based defense mechanics
  • Building + combat + resource management
  • Father-son educational codebase
  • Readable, well-commented code by design

How We Can Help

Decades of experience distilled into services that actually move the needle

Security Architecture

Zero trust, cloud security, network segmentation. Built on decades of what actually holds up.

Penetration Testing

Real-world attack simulations. Findings with context, not vulnerability dumps.

Compliance & Regulatory

FedRAMP, CMMC, SOC 2, HIPAA, PCI-DSS, ISO 27001, NIST CSF, CIS Controls.

Incident Response

24/7 emergency response. Forensics, containment, recovery. Been there before.

Virtual CISO

Senior security leadership without the salary. Shows up in the server room, not just the boardroom.

Executive Advisory

Translate technical risk into board-level decisions. M&A due diligence. Expert witness.

View All Services
CISSP CISM Certified Blockchain Professional Expert Witness 3 Issued Patents

Bring Your Hardest Problem.

First conversation is free. No pitch deck. No sales team. Just an experienced CISO who will tell you what's actually broken and help you fix it.

Book a Free Consultation