Related product
FlagshipIn development
ITSRM2+
Security risk assessment aligned with ITSRM2, extended for AI and supply chain risks.
Web
How we help
Risk assessment, security and compliance consulting, secure self-hosted tools and AI agent workflows. Each section says who it is for and what you receive.
Risk assessment
A structured security risk assessment aligned with the ITSRM2 methodology, from system scope to a treatment plan your team can act on.
I lead risk assessments and Business Impact Assessments on EU and public sector projects, aligned with the publicly available ITSRM2 methodology. The work follows the method step by step: characterise the system, value what matters, identify the risk scenarios, then choose and apply security measures and see how the residual risk changes.
I deliver the assessment with ITSRM2+, the tool I built for my own risk work. Every output is available as a one click export, so you receive the formats your team and your auditors need: an Excel risk register, a Word report, JSON, a Statement of Applicability for each compliance pack, estimates of financial exposure and risk images.
I run the meetings with project managers and asset owners, explain each risk in plain language and gather the input the assessment needs. Where your system uses AI or depends on a software supply chain, the assessment covers those threats too, with the extended threat library built into ITSRM2+.
Who it is for
- Companies that need a documented risk assessment for NIS2, DORA or ISO 27001 work
- Public bodies and their suppliers that follow a structured methodology
- Teams adding AI systems or new software supply chains to an existing service
- Project and risk owners who must explain risk to management
What you get
- A system characterisation with scope, security roles, constraints and risk acceptance criteria
- Valued assets, with a Business Impact Assessment behind each rating
- Risk scenarios, including AI and supply chain threats where they apply
- A treatment plan with security measures and the change from inherent to residual risk
- Any output you need, each a one click export from ITSRM2+, such as an Excel risk register, a Word report, a Statement of Applicability, estimates of financial exposure in EUR shown as ranges, and risk images
Security and compliance consulting
Gap reviews, internal audit work, security plans and vulnerability follow-up, with ISO 27001, ISO 22301, NIS2, DORA and GDPR as the reference.
Security and compliance work only helps when people can act on it. I run gap reviews and internal audit work, on my own or as part of a team, draft and update security plans and policies, organise vulnerability assessments and penetration tests, follow the remediation of the findings, and report progress in a way that management can read.
I hold ISO 27001 and ISO 22301 Lead Auditor certificates, and my background includes two years of IT general controls audits. I am not a certification body and I cannot certify your organisation: I help you prepare, find the gaps and fix them before the certification audit.
I can also act as the security contact of a project, overseeing security measures and coordinating internal communication during a security incident.
Who it is for
- Organisations preparing for an ISO 27001 or ISO 22301 certification audit
- Companies in scope of NIS2 or DORA that need to turn requirements into measures
- Project teams that need a security officer for a defined period
- Teams that handle personal data and want a GDPR security view
What you get
- A gap review against the standard or regulation you work with, with prioritised actions
- Internal audit work, on my own or as part of your audit team
- Security plans and policies, drafted or updated for your systems
- Coordination of vulnerability assessments and penetration tests, and follow-up of the findings
- Vulnerability and maturity reporting with a clear before and after view for management
- Security awareness training for your staff
Secure self-hosted tools
Web and Android tools built with AI agents, hardened by a security professional, and designed to run on infrastructure you control.
I host my own tools on my own server at my home in Greece. Greek Freelancer Finance reads my AADE myDATA invoices, Tasks is a private kanban with an Android app unlocked by fingerprint, Job Tracker is my job search CRM with passkey and TOTP sign in, and Marangos turns cabinet dimensions into a workshop PDF without storing anything. The database sits on an internal network, containers run without root, and there are no analytics.
I plan to publish these tools as open source. Anything I publish, your organisation can host on its own infrastructure, with your data on your own servers. I can help you set it up and harden it, or build a tool around your workflow the same way.
I build with AI agents, working from written requirements, security rules and tests that must pass, and I review the result as a security professional before it goes live.
Who it is for
- Small companies and teams that do not want sensitive data in a SaaS cloud
- Professionals who need a tool for one specific job, such as finance, tasks or planning
- Organisations that want to run a tool on their own infrastructure, with login and no tracking from day one
What you get
- A tool you host on your own infrastructure, from the ones I publish as open source or built around your workflow
- A hardened deployment, with containers that run without root, no public database port and strict security headers
- Login, backups and no tracking, designed in from the start
Related product
ProductLive
Greek Freelancer Finance (GFF)
Your myDATA invoices, income and tax estimates in one private, self-hosted view.
Web, Android
Related product
ProductLive
Tasks
A private kanban for work and life, self-hosted in Greece instead of a SaaS cloud.
Web, Android
Related product
ToolLive
Marangos
Exact cut lists and drilling plans for the cabinets you build yourself.
Web
Related product
ProductLive
Job Tracker
The recruiter calls. The application, the emails and the CV you sent are on screen.
Web
AI agent workflows
Training, agent workflows and hands-on guidance that help your team use AI agents on real work, with review points where a person decides.
I use AI agents every day, in two ways. In security work, local LLM tools help me improve the quality of risk reports and draft security scenarios faster, without sending documents to a cloud service. In software, teams of agents with defined roles (planning, coding, review and testing) build my products under written rules, with gates where I approve the result. This website was built the same way.
One example from my risk work: a set of AI agent skills that walks the ITSRM2 processes, P1 to P7, one step at a time with a review after each step, and exports the risk register to Excel. It is a separate agent workflow, not part of the ITSRM2+ app.
I offer this as training, as agent workflows built for your process, and as guidance for your team while it adopts them. AI Architect shows the private side: a local AI that redesigns a room from one photo, running on my own machines, with no cloud service seeing the photos.
Who it is for
- Security and GRC teams that spend days on repetitive drafting and reporting
- Development teams that want to build with AI agents under clear rules and reviews
- Companies that want to use AI without sending sensitive documents to a cloud service
- Teams that want to try AI agents on a real process, with clear review points
What you get
- Training for your team on working with AI agents, prompts, review and safe use
- A working agent workflow with defined roles, review gates and written outputs
- A map of which steps in your process an agent can take on, and where a person must approve
- Guidance while your team adopts the workflow, including local models where documents must stay in house
Related product
Lab projectPrototype
AI Architect
A private AI interior designer: one room photo in, redesigns out, no cloud.
Web (local only)
Not sure where to start?
Tell me what you are trying to protect or build, and I will say honestly whether I can help.