Automotive Manufacturing
Supply Chain Security Transformation
Secured 19 subdivisions of North America's leading vehicle wholesaler with a DevSecOps programme spanning 50+ delivery teams.
- 90%
- Review time reduction
- 50+
- Dev teams secured
Enterprise security consultancy
Security that holds up under audit.
We design security architecture and governance for organisations where a control failure is a business event — then we help you prove the controls work.
- Years in cybersecurity
- 20+
- AppSec practice built
- $8.4M
- Enterprise case studies
- 11
What we do
Three practices, engaged separately or together. Every engagement ends with artefacts your team owns — not a slide deck.
01
Security Architecture
Zero-trust design, cloud architecture, and reference patterns that delivery teams can actually build against.
- Architecture reviews
- Zero-trust roadmaps
- Decision records
02
Governance & Assurance
Control frameworks and evidence pipelines that prove what you claim — to auditors, regulators, and your board.
- SOC 2 / HIPAA / PCI DSS
- Control rationalisation
- Board reporting
03
AppSec & DevSecOps
Guardrails in the pipeline instead of gates in front of it, so security scales with the platform.
- Programme design
- Supply chain security
- Pipeline guardrails
Practitioner-led, enterprise-proven
Phenom Security is led by Aaron Smith — a hands-on security architect with 20+ years securing Fortune 100 enterprises. The person who designs your governance framework is the person who writes the code that enforces it.
More about the practice- Fortune 100 track record
- AON, McDonald's, and regulated financial services engagements.
- AI security since 2002
- From Bayesian classification to enterprise GenAI platform architecture.
- Builder, not just advisor
- Writes production code, configures infrastructure, deploys alongside your teams.
- US-based and direct
- Time-zone alignment and a single accountable practitioner on the engagement.
Selected work
All case studiesFood Service / Global
Global Automation Security Framework
Designed the security framework for a Fortune 500 restaurant corporation's automation programme across a very large distributed estate.
- 30K+
- Locations
- 100K+
- IoT devices
Financial Services
Security Infrastructure Consolidation
Rationalised the global security perimeter for a Fortune 500 financial corporation without reducing control coverage.
- 40%
- TCO reduction
Latest writing
All insightsEnvironment Separation Is a Claim Until Someone Reads the Config
A production service that answered every check was reading development tables and publishing an index with no version history in it at all.
Cloud SecuritySecurity Architecture8 min
What Dies First When You Retire a Service
Retiring a service is an ordered operation with a preservation gate that has to be verified before anything is destroyed, and a list of consumers that no inventory holds.
Cloud SecuritySecurity Architecture8 min
What Leaks Through the Pipe That Publishes
A private-to-public sync excluded every file it was supposed to exclude and still published the committer's identity, the commit bodies, and a sentence naming the directory it had just hidden.
DevSecOpsSupply Chain8 min
Newsletter
Stay ahead of emerging threats
Security research, threat intelligence, and compliance analysis — sent when there is something worth reading.
No spam. Unsubscribe anytime. We respect your privacy.
Contact
Start a conversation
Tell us what you're trying to secure and what's in the way. We respond within one business day.
- info@phenomsec.com
- Headquarters
- Portland, OR