// Who We Are
ctfwithai is a practitioner-led cybersecurity firm. We were founded by engineers who had spent years running engagements delivered by other firms and consistently found the same problem: the people who sold the work were not the people doing it.
We built ctfwithai to operate differently. Every engagement is owned end-to-end by the practitioner who scoped it. Our team spans offensive security, threat intelligence, cloud architecture, compliance, detection engineering, and training. That breadth is not a marketing claim — it reflects the actual expertise of the people on the team.
// What We Do
Most security firms are either offensive shops or compliance consultancies. We cover the full spectrum because real security problems rarely stay in one lane. A red team finding that requires a cloud IAM fix, a compliance programme that needs threat modelling input, a SOC alert that turns into an incident response — these cross disciplines, and so do we.
// How We Work
// The Team
Our team is deliberately small and deliberately senior. Every person listed here is an active practitioner, not a manager. They hold certifications in their discipline but more importantly they hold track records of doing the work.
Founder & Lead Security Engineer
Saad founded ctfwithai after a decade in offensive security, having run red team operations for financial institutions and critical infrastructure operators. His focus on AI security began with some of the earliest LLM deployments in production environments, where he identified the gap between how AI systems were being built and how they could be attacked.
Head of Threat Intelligence
Aryan spent seven years in government threat intelligence before joining ctfwithai. He built the team's threat intelligence capability from the ground up, establishing the monitoring infrastructure, source network, and analytical methodology that now underpins client intelligence programmes and The Bridge platform.
Cloud Security Lead
Priya came to security from a software engineering background, which shapes how she approaches cloud assessments: she looks for what developers actually build rather than what security checklists assume. She has run cloud security programmes for SaaS companies scaling from startup to enterprise and holds deep expertise in AWS, GCP, and Azure identity and access management.
GRC and Compliance Lead
James has led compliance programmes at organisations ranging from regulated financial services firms to early-stage SaaS companies. His approach is to build controls into operational processes rather than treat compliance as a documentation exercise. He has guided clients through ISO 27001 certification, SOC 2 Type II audits, and NIS2 readiness reviews across multiple EU jurisdictions.
Defensive Security and Detection Engineer
Leila built and ran SOC teams at a managed security service provider before moving to consultancy. She specialises in detection engineering: building rule sets that fire on real attacks rather than generating alert noise, and in incident response for organisations that do not have an internal capability when something goes wrong. She has responded to ransomware incidents across manufacturing, healthcare, and retail.
Security Training Lead
Marcus has trained over 25,000 developers, security engineers, and non-technical staff across financial services, technology, and public sector organisations. He designs training programmes grounded in real attack scenarios rather than compliance checkboxes, and leads our CTF competition design work which underpins the ctfwithai name.
// The Name
CTF stands for Capture the Flag — the competitive security challenges that most practitioners use to sharpen their skills. They require the same thinking as real attacks: patience, lateral reasoning, and deep technical knowledge applied under pressure.
The AI component reflects where security is heading. AI systems introduce attack surfaces that conventional tools were not built for. We started working on LLM security assessments before most firms knew what prompt injection was, and that early investment in understanding the new attack surface is now a core part of what we offer.
The name also reflects how we approach problems: like a CTF challenge, with curiosity, rigour, and the expectation that the answer is there if you are methodical enough to find it.
$ whoami
ctfwithai — full-spectrum cybersecurity
$ cat mission.txt
Reduce actual exposure. Demonstrate the difference. No bloated retainers. No off-shore hand-offs.
$ cat team.txt
6 practitioners. 6 disciplines. One accountable team.
$ cat scope.txt
Offensive · Defensive · AI · Intelligence · GRC · Training
// Work With Us
We scope every engagement from scratch. No templates, no upsell. Just an honest assessment of what your environment needs.
Get a Quote