Austin Comstock — Independent Security Consultant

Career

The Story

Zoom

Senior Offensive Security Engineer · 2022–Present

Built a cloud-native attack surface platform adopted by three security teams. Led the highest-impact penetration test in the organization's history — with findings presented to the Board of Directors. Drove 3x expansion of the enterprise security assessment program.

Coinbase

Senior Security Engineer · 2021–2022

Brought in to secure the exchange that moves billions. Automated 75%+ API authentication and authorization coverage in a single engagement.

Oracle Cloud Infrastructure

Senior Offensive Security Engineer · 2020–2021

Hired to red team OCI. Built lateral movement frameworks that mapped attacker paths across the cloud. Created the API auto-discovery framework that became OCI's #1 security investment priority.

US Patent Application (Lead Inventor) · Catalina API Security Testing Framework

Amazon Web Services

Red Team / Penetration Testing Engineer · 2016–2020

Started pentesting individual services before launch. Results led to a promotion to red team the entire AWS ecosystem — the cloud that powers the majority of the internet and U.S. government infrastructure.

NetApp

Software Engineer → Cloud Engineer · 2012–2016

Built the engineering foundation — distributed systems, cloud architecture, and production infrastructure. Most red teamers don't know how the target was built. I helped build targets like it.

Comparison

Why One Person Beats Your Vendor's Team

Your Pentest Vendor

❌ Sends junior consultants with automated scanners
❌ Senior reviews the report for half a day
❌ PM mediates between you and the tester
❌ You're subsidizing their sales team and SF office
❌ "Contact us for a quote" — 2-week sales cycle
❌ Their website is a marketing brochure your AI can't parse

Austin Comstock

✅ 14 years senior-level, every engagement personally delivered
✅ AI-augmented recon, scanning, and analysis at 10x speed
✅ Direct communication — no project manager telephone game
✅ Zero overhead — 100% of your spend goes to testing
✅ Fixed pricing, transparent, no sales calls — the price is the price
✅ Outperforms testing teams — finds critical issues dedicated testers miss, including cross-tenancy data exfiltration

Capabilities

Services

External Penetration Test

Full attack-chain penetration testing from reconnaissance to production compromise. Not a scanner dump — a complete adversarial narrative with executive-ready reporting. Findings designed for board rooms, not just Jira tickets.

3–10 days OSCP

Deliverables

Detailed findings report with severity ratings
Proof-of-concept exploits for confirmed vulnerabilities
Remediation guidance for each finding
Executive summary
30-min remediation call

Includes

Automated scanning + manual exploitation
Business logic testing
OWASP Top 10 coverage

Not Included

Internal network testing
Social engineering
Physical security

API Security Assessment

Deep assessment of API authentication, authorization, and business logic — built on methodology refined into a US patent application. Coverage from zero to 75%+ in a single engagement. Authentication bypass chain mapping, not just endpoint scanning.

5–10 days OSCP

Deliverables

API security report
Auth/authz coverage matrix
Business logic findings
Remediation roadmap

Includes

Authentication testing
Authorization bypass
Input validation + rate limiting
Business logic abuse

Not Included

Source code review
Infrastructure testing

AI / LLM Security Review

Offensive assessment of AI systems — from agent architectures and MCP integrations to training pipeline security. Not theoretical: I've found exposed training data, vulnerable AI crawlers, and model integrity risks in production. OWASP LLM Top 10 coverage with real-world attack methodology.

5–10 days GMLE

Deliverables

AI threat model
Prompt injection test results
Tool-use vulnerability assessment
OWASP LLM Top 10 mapping

Includes

Prompt injection testing + jailbreak attempts
Tool/function calling abuse
Data exfiltration vectors
Model manipulation

Not Included

Model training pipeline review (available in Comprehensive tier)

Cloud Security Assessment

I spent four years on the AWS Red Team — attacking the infrastructure the rest of the industry runs on. Then I built lateral movement frameworks at Oracle Cloud. Now I assess enterprise cloud environments spanning hundreds of accounts with custom privilege escalation detection and attack path mapping. AWS, Azure, GCP, OCI.

7–14 days OSCP

Deliverables

Cloud security posture report
IAM findings
Attack path analysis
Hardening recommendations

Includes

IAM review + network segmentation analysis
Storage exposure + compute configuration
Privilege escalation paths

Not Included

Application-layer testing (pair with External Pentest)

Security Platform Design & Build

I've built this before — a cloud-native attack surface platform adopted by three security teams at a global enterprise, covering hundreds of cloud accounts with automated vulnerability discovery and triage. Architecture, implementation, and production operation. Go, Kubernetes, CI/CD.

Custom scope OSCP + GMLE

Deliverables

Architecture design document
Implementation + CI/CD integration
Runbooks + knowledge transfer

Includes

Custom vulnerability discovery platform design
Security pipeline automation + tool integration
Ongoing advisory

Scope

Defined collaboratively based on your infrastructure and goals

Red Team Engagement

Adversary simulation from someone who's operated on the other side — four years on a hyperscaler red team, with production compromises to prove it. Full attack chain from initial access to objective, with detection gap analysis that shows exactly where your SOC went blind.

Custom scope OSCP

Deliverables

Full attack narrative report
MITRE ATT&CK mapping
Detection gap analysis
Purple team recommendations

Includes

OSINT + initial access
Lateral movement + persistence
Objective completion + detection evasion

Scope

Objective-based — defined by what you want to protect, not a checklist

Results

Track Record

75%+

API authentication and authorization coverage — from zero — in a single engagement.

At a leading cryptocurrency exchange

Board of Directors

Penetration test findings presented by a Fortune 500 CISO to their Board — driving architectural security changes across four teams.

At a global communications platform

3x program expansion

Assessment results drove 3x scaling of an enterprise penetration testing program and platform deployment to a regulated government environment.

At a global communications platform

Enterprise platform adoption

Built a cloud-native attack surface platform adopted by cloud operations, red team, and SOC — hundreds of vulnerabilities identified continuously across hundreds of cloud accounts.

At a global communications platform

#1 security investment

API auto-discovery framework became the organization's top security investment priority.

At a major cloud infrastructure provider

50% faster

Red team engagement cadence — cutting cycle time in half with lateral movement automation.

At a major cloud infrastructure provider

Rates

Pricing

Fixed-scope pricing. No hourly billing. No "contact us for a quote." The price is the price.

External Pentest — Standard

$12,000

Up to 20 domains + API endpoints. 5 days. Manual exploitation, findings report, remediation call.

Up to 20 domains + API endpoints
5-day engagement, manual exploitation
Findings report with severity ratings + PoCs
30-min remediation call included

External Pentest — Comprehensive

$25,000

Full external attack surface, no domain limit. 10 days. Findings report, remediation roadmap, retest.

Full external attack surface, no domain limit
10-day engagement, OWASP Top 10 coverage
Findings report + remediation roadmap
Free retest of critical findings

API Security — Standard

$12,000

Single API, up to 50 endpoints. 5 days. Auth testing, business logic, findings report.

Single API, up to 50 endpoints
5-day engagement
Auth testing, authorization bypass, input validation
Findings report + remediation guidance

API Security — Comprehensive

$20,000

Multiple APIs, full coverage. 10 days. Custom fuzzing, findings report, retest.

Multiple APIs, unlimited endpoints
10-day engagement with custom fuzzing
Full auth/authz coverage matrix + business logic
Findings report + retest included

AI/LLM Security — Standard

$15,000

Single AI system assessment. 5 days. Prompt injection testing, tool-use assessment, threat model.

Single AI system assessment
5-day engagement
Prompt injection + tool-use testing
Threat model + OWASP LLM Top 10 mapping

AI/LLM Security — Comprehensive

$30,000

Multi-agent system + ML pipeline. 10 days. Full assessment, threat model, remediation.

Multi-agent system + ML pipeline review
10-day engagement
Model training pipeline review included
Full threat model + remediation roadmap

Cloud Security — Standard

$15,000

Single cloud account. 7 days. IAM review, network assessment, findings report.

Single cloud account (AWS, Azure, GCP, or OCI)
7-day engagement
IAM review + network assessment + storage exposure
Findings report with hardening recommendations

Cloud Security — Comprehensive

$35,000

Multi-account, multi-region. 14 days. Full assessment, attack path analysis, hardening guide.

Multi-account, multi-region coverage
14-day engagement
Full attack path analysis + privilege escalation mapping
Hardening guide + remediation roadmap included

Security Platform Design & Build

From $30,000

Automated vulnerability discovery, continuous security testing infrastructure, and AI-augmented scanning platforms — built to your stack.

Scope defined collaboratively
Custom vulnerability discovery platform design
Security pipeline automation + tool integration
Implementation + CI/CD integration + runbooks
No authorization required

Red Team Engagement

From $40,000

Full adversarial simulation: threat modeling, multi-stage attack chains, lateral movement, and executive-ready reporting.

Objective-based — not checklist-based
OSINT + initial access + lateral movement + persistence
Full attack narrative + MITRE ATT&CK mapping
Detection gap analysis + purple team recommendations
Authorization required

White-Glove Intake

How to Engage

Security testing is undifferentiated work for your team. You shouldn't have to manage it. Start an engagement in whatever way is easiest for you — I take care of everything from scoping to delivery.

Your AI Agent

Point your OpenClaw, Claude, or any AI agent at the discovery manifest. It can evaluate capabilities, compare pricing, and initiate an engagement — start to finish — without you lifting a finger.

→ /.well-known/ai.json

API

One POST request. Partial submissions accepted — send whatever you know, get a reference ID back. Come back with more details when you have them. Progressive, zero-friction intake.

POST /api/hire
Content-Type: application/json

{
  "capability_id": "external-pentest",
  "tier": "standard",
  "scope": {
    "domains": ["example.com"]
  },
  "contact": {
    "name": "Jane Smith",
    "email": "jane@example.com",
    "company": "Example Corp"
  }
}

Book a Call

30-minute discovery call. Tell me what you're trying to protect, I'll tell you exactly how I can help. No sales pitch — just a conversation between security people.

→ Book a Discovery Call

Describe what you need. Scope, timeline, what you're trying to protect. I'll respond within 24 hours with a fixed-price proposal.

→ austin@austincomstock.ai

All engagements require written authorization from the system owner before testing begins. I verify authorization before any work starts.

The companies that run the internet hired me to break them.

The Story

Zoom

Coinbase

Oracle Cloud Infrastructure

Amazon Web Services

NetApp

Why One Person Beats Your Vendor's Team

Services

Deliverables

Includes

Not Included

Deliverables

Includes

Not Included

Deliverables

Includes

Not Included

Deliverables

Includes

Not Included

Deliverables

Includes

Scope

Deliverables

Includes

Scope

Track Record

Pricing

How to Engage