Every engagement is personally led by Kevin Geil — GIAC Security Expert (GSE #357), CISSP, and MSISE. Placid Security works with organizations of all sizes, from small businesses to public-sector authorities, to test defenses, improve security posture, and respond to incidents with precision.
Structured security assessments following the Penetration Testing Execution Standard (PTES), delivered with expert-written reports and clear remediation guidance your team can act on.
Specializations include:
Active Directory attack path analysis — privilege escalation, Kerberoasting, AS-REP roasting, and AD tier segmentation review using BloodHound. Network and internal assessments. Web application testing (GWAPT-certified). Azure and AWS identity and IAM configuration review.
Reports are written for both technical teams and executive stakeholders, with findings prioritized by exploitability and business impact.
When an incident occurs, speed and expertise matter. Placid Security provides full-lifecycle incident response support — from initial scoping and containment through threat eradication, forensic analysis, and recovery.
Platform experience includes CrowdStrike, Carbon Black, and Cybereason. Custom IR tooling (PowIRShell) supports EVTX triage, Microsoft 365 log analysis, threat actor attribution via threat intelligence APIs, and BEC investigation including mailbox rule analysis and attachment access tracking.
Retainer arrangements available for organizations that want guaranteed response capacity.
You can't defend what you can't see. Attack surface management gives you continuous visibility into your external exposure — internet-facing assets, open services, misconfigured systems, and exploitable entry points — before adversaries find them first.
Engagements include asset discovery, exposure analysis, prioritized findings, and guidance on reducing your organization's footprint.
Cloud misconfigurations are among the most common root causes of breaches. Placid Security performs cloud security assessments across Azure and AWS environments, focusing on identity and access management, privilege escalation paths, storage exposure, logging gaps, and configuration review against security benchmarks.
Microsoft 365 and Azure tenant security — including Active Directory, Conditional Access, and Entra ID — is a particular area of depth.
Compliance doesn't have to mean checkbox exercises. Placid Security helps organizations build security programs that are both audit-ready and genuinely effective — grounded in the same frameworks assessors use, but implemented with real-world practicality.
Framework expertise includes: PCI-DSS, HIPAA, NIST Cybersecurity Framework (CSF), CIS Critical Security Controls, and NCSR maturity assessments.
Services include gap assessments, policy development, risk assessment (CIS RAM), security program roadmapping, and compliance preparation.
Not every organization needs a full-time CISO — but every organization needs security leadership. Placid Security provides fractional CISO services: translating technical risk into business language, advising executive and board-level stakeholders, and building the strategic roadmap your security program needs.
Grounded in 15+ years of practitioner experience that spans both hands-on security work and program leadership for a New York State public authority.
Your incident response plan is only as good as the last time you tested it. Placid Security designs and facilitates realistic tabletop exercises for technical teams, executives, and boards — tailored to your industry, your environment, and your actual business continuity plans.
Scenarios are built around relevant threats, not generic templates. Every exercise produces actionable recommendations to strengthen your plans and close gaps before a real incident reveals them.
New York's new cybersecurity requirements for community drinking-water systems take effect January 1, 2027, wastewater systems face their own new DEC rules, and SECURE grants are helping towns pay for the work. Placid Security helps municipalities plan the project, complete the required cybersecurity vulnerability analysis, and put the approved safeguards in place — working carefully around operational technology and the people who run it.
Reach out to discuss your security needs. Engagements are scoped individually — no one-size-fits-all packages.
Contact Placid Security