A small firm with a large evidence trail

The founder

Firebed's founder spent their earlier career in UK government cyber-security regulation, working with the Network and Information Systems Regulations 2018, the NCSC Cyber Assessment Framework that competent authorities assess against, and the policy work that became the Cyber Security and Resilience Bill. That background is unusual in a firm that also writes production cryptography, and it is the point: Firebed reads a control the way an assessor reads it, and builds it the way an engineer builds it.

A fuller biography, with the founder's name, will appear here once the company's public profile is complete.

How we work

• No claim without evidence. A status advances only on implementation-level evidence. A claim no run has yet shown is written believed, unverified until one does.
• Fail closed. A command that cannot do the work refuses it by name. A listener that would reach beyond a private network refuses to start unless told otherwise. A control with no call site is recorded as an intention, not a control.
• One record. Requirements, risks, decisions and deviations live in registers with permanent identifiers. Superseded text is kept visible, marked superseded, never silently rewritten.
• Fix the class. A finding closes when the defect class is closed and a regression gate guards it, not when the instance is patched.
• Measure the work. Every tranche of engineering reports its wall-clock time, its tokens by model and its price, so the cost of quality is known rather than guessed.

The Cyber Verification Program, and what it is not

Firebed is a verified organisation in Anthropic’s Cyber Verification Program. Anthropic applies real-time safeguards to its frontier Claude models that restrict dual-use cyber capabilities by default; the programme is the mechanism by which organisations doing legitimate defensive security work are verified and admitted to those capabilities for authorised use.

It is a verification of who Firebed is and what it does. It is not a certification of Firebed's services, not an endorsement by Anthropic, and not a licence to test anything Firebed is not otherwise authorised to test. We use it for authorised defensive work, on systems we own or are engaged to assess, under written rules of engagement, and we say so on every engagement.

Intellectual property

Deliverables produced for a client belong to the client on the terms of the engagement. ExPriori's intellectual property is held by Firebed so that the perpetual free licence to NHS organisations can be granted cleanly and the platform maintained; the licence is as-is, non-exclusive, and confined to the field it names. Where a client's work would benefit from methods developed on ExPriori, the engagement says so in advance.