Who we are and how we work
Company and security
Who operates CyberCore Security, the assessment services we provide and how they are authorized and scoped, a synthetic lab work sample, and how to contact us about sensitive material.
Business identity
- Legal name
- CYBERCORE SECURITY LLC
- Trading brand
- CyberCore Security
- Location
- Edmond, Oklahoma, United States
- Formed
CyberCore Security is the name CYBERCORE SECURITY LLC trades under. The same company is the listed seller of Pace & Plates on the Apple App Store, one of its consumer app projects.
Who does the work
Joshua Jackson
Joshua Jackson is the security consultant behind CyberCore Security and the direct contact for every inquiry and engagement.
His work covers cybersecurity and IT consulting, network and endpoint administration, and application security. That is the same ground CyberCore’s assessments cover: how systems, networks, endpoints, and applications are configured, and where that configuration leaves a business exposed.
This page lists no certifications, titles, or employer history. Professional credentials are published here only alongside a link that lets you check them with the issuer.
Assessment services and process
CyberCore works with small and mid-sized organizations. Every engagement is scoped in writing around a named environment before work starts.
What we provide, and what it covers
- Security assessment
- A focused review that identifies weaknesses, explains their business impact, and delivers clear, prioritized findings.
- Covers: Your systems, network, endpoints, and current security practices, as named in the written scope.
- Hardening and remediation guidance
- Prioritized, practical guidance tailored to your environment, risk tolerance, and operational needs, with follow-up to clarify findings while your team works through them.
- Covers: The findings from an assessment and the environment they came from.
- Ongoing consulting
- Help evaluating risk, making informed decisions, and improving a security program over time.
- Covers: Security decisions and security-minded IT support for teams without an internal security function.
- AI coding agent security review
- A configuration review that ends in a written report with prioritized fixes and a follow-up call to walk through them.
- Covers: The repositories and CI workflows you name: agent settings, hooks and permission allowlists, MCP server configuration, pipelines that run agents with secrets in reach, and instruction files such as AGENTS.md and CLAUDE.md.
These are assessment and review services. Penetration testing is not sold as a standard package. Where an engagement calls for active testing, it is scoped separately and only begins after the system owner has authorized it in writing.
CyberCore does not test systems for anyone who lacks the authority to approve that testing, and does not work outside the agreed scope.
How an engagement runs
- Discovery. We learn about your environment, concerns, and goals, then confirm whether CyberCore is the right fit.
- Written authorization and scope. Before any work begins, we agree in writing on authorization, boundaries, timing, deliverables, and how information will be handled.
- Assessment. We evaluate the agreed systems and controls carefully, within the authorized scope.
- Prioritized findings. We explain the risks, business impact, and priorities in executive and technical language, organized by severity so you know what matters first.
- Remediation guidance. We answer questions and clarify recommended next steps while your team works through fixes.
- Validation, when scoped. Checking that a fix worked is done only when the written scope includes it. It is not assumed, and it is not included by default.
Evidence of work
Synthetic agent workflow lab
Prepared . Re-run .
The lab models one small workflow: a scripted planner reads a fictional support ticket and proposes a note, and a separate permission boundary decides whether that exact note may be written to an in-memory list. The planner is deliberately naive and adopts whatever the untrusted ticket proposes, so every case tests the boundary rather than the planner.
The final run passed 24 of 24 defined scenarios and 31 of 31 behavior checks. Re-running the unchanged source on the later date reproduced the same 24 scenario outcomes and the same source file hashes.
The 24 scenarios and what was observed
- LAB-01 Allowed ticket read returns a copy
- Allowed; stored ticket unchanged
- LAB-02 Untrusted proposal requests an unauthorized tool
- Denied: tool not allowed
- LAB-03 Untrusted proposal uses a permitted tool without approval
- Denied: approval required
- LAB-04 Out-of-scope ticket read
- Denied: resource not allowed
- LAB-05 Wildcard and extra-tool capability grants
- Three invalid grants rejected
- LAB-06 Fabricated approval
- Denied: approval unknown
- LAB-07 Exact approved note
- Written once
- LAB-08 Changed payload reusing an approval
- Denied; the original exact action then succeeded
- LAB-09 Changed target reusing an approval
- Denied: action mismatch
- LAB-10 Changed operation identifier reusing an approval
- Denied: action mismatch
- LAB-11 Approval used at its exact expiry
- Denied: approval expired
- LAB-12 Replay of a consumed approval
- Denied; still one note
- LAB-13 Different actor using the grant
- Denied: actor not allowed
- LAB-14 Policy change after approval
- Denied: policy mismatch
- LAB-15 Known failure before commit
- No effect confirmed; the same valid approval retried; one note
- LAB-16 Uncertain outcome after commit
- Blind retry denied; receipt reconciled; still one note
- LAB-17 Path traversal and absolute destinations
- Three destination strings rejected
- LAB-18 Unexpected action fields
- Denied: action invalid
- LAB-19 Revoked approval
- Denied: approval revoked
- LAB-20 Second approval for an already committed operation
- Denied; still one note
- LAB-21 Evidence links source, proposal, approval, and outcome
- Ordered evidence chain verified; note body omitted
- LAB-22 Local edit to a recorded event
- Edit detected by the hash chain
- LAB-23 Reordered keys in an approved action
- Same canonical digest; written once
- LAB-24 Reconciliation with the receipt missing
- Left unresolved; original and fresh-approval retries both blocked
What this does not show
- All data is fictional. No real model, customer system, external target, credential, network call, or paid service was involved.
- Passing 24 fixed scenarios is not a protection rate, a benchmark, or evidence that any real agent resists prompt injection.
- The fixture is a single-process, in-memory model with a simulated approver. It has no real identity system, durable storage, or concurrency, and its audit hash chain is unkeyed, so it detects only edits made without recomputing the hashes.
- The scenario design draws on OWASP’s published guidance on prompt injection and excessive agency. It is not an implementation or certification of that guidance.
Background reading: OWASP LLM01:2025 Prompt Injection and OWASP LLM06:2025 Excessive Agency.
No client reports, testimonials, or case studies appear on this site.
Security contact and information handling
Security contact: joshua@cybercoresecurity.com
Before you share anything sensitive
- Email a short description of what you need to share. Keep the message itself non-sensitive: say what kind of material it is, not what it contains.
- We reply to agree on a transfer method suited to that material and on how it will be handled.
- Send the material only after that method is agreed, and only by that method.
- Do not send credentials, vulnerability evidence, system exports, or sensitive client data through the website contact form or by ordinary email.
- We aim to reply within one business day.
- This address is not an emergency channel and should not be relied on during an active incident. Use your established response provider or emergency escalation process.
- To report a security problem with this website, use the same address and the same steps.
This page makes no general promises about encryption, retention periods, incident response times, or compliance certifications. For an engagement, handling expectations are written into the scope before confidential details are exchanged.