ringnull
./contact
Menu

tim@ringnull:~$ cat mission.md

Security starts in the innermost ring.

ringnull is the security practice of Tim Fiedler. I review and harden LLM applications, RAG pipelines and the cloud and identity infrastructure they run on.

Get in touch View services
Focus
AI & IT security, social engineering, forensics
Experience
20+ years of software engineering
Sectors
Banking, MedTech, industry, energy
Location
Remote DACH, on site near Oldenburg

ring 3services

Four disciplines, one principle.

Security is decided in the architecture. I look at the places where people, data, permissions and models meet, and harden the system there. And if something has happened anyway, I find out what.

01

AI security

threat-modeling · prompt-injection · data-poisoning · retrieval-acl · mcp-scopes

A language model gets access to confidential data or internal systems and has to stand up to an audit.

Securing RAG pipelines and LLM applications: who gets to see which documents, which inputs may steer the model and which actions an agent may take. With project experience up to the high-security zone of a bank.

  • Threat modeling for LLM and agent applications
  • Prompt injection and data poisoning in RAG pipelines
  • Permission checks at retrieval time
  • Limiting the tool and MCP access of agents
  • Hardened runtimes for models and gateways

02

IT security & IAM

oauth2/oidc · keycloak · okta · hardening · ci/cd-scanning · mdr

Your systems process health, banking or business data and are subject to regulatory requirements.

The infrastructure beneath the application: identities, permissions, network, build and operations. I check whether the configuration keeps what the architecture promises, and close the gaps in between.

  • Identity and access management with OAuth2/OIDC
  • Keycloak, Okta, Auth0, Cidaas
  • Hardening of cloud environments and containers
  • Security scanning in CI/CD pipelines
  • MDR compliance in MedTech

03

Social engineering

phishing-simulation · vishing · pretexting · awareness · physical-access

The technology is secured, but an attacker simply asks a person for the password.

I test whether processes and people withstand a targeted deception attempt, and turn the results into something the team can use. Every campaign is agreed in writing beforehand with management and, where one exists, with the works council.

  • Phishing simulations with agreed scenarios
  • Phone and pretexting tests (vishing)
  • Review of approval and call-back processes
  • Awareness training based on the results
  • Reporting that never exposes individual employees

04

IT forensics

incident-response · log-analysis · evidence-preservation · cloud-forensics · timeline

There was an incident, or a suspicion, and you need to know what happened.

I establish how an attacker got in, what they reached and whether they are still there. The findings are documented so others can follow them, and they feed straight into hardening, so the same path does not work twice.

  • First response and containment during an incident
  • Evidence preservation with a documented chain of custody
  • Analysis of logs, systems and cloud environments
  • Reconstruction of the attack timeline
  • Report for management, insurers and authorities

ring 2approach

From perimeter to ring 0.

Every engagement follows the same sequence. It ends with a report of prioritised, actionable measures.

  1. 01

    Scope

    We define which systems, data and interfaces are in scope and which risks matter.

  2. 02

    Analysis

    Threat model, architecture and configuration review, targeted tests against the agreed attack surface.

  3. 03

    Hardening

    Concrete measures, prioritised by risk. If you like, I implement them together with your team.

  4. 04

    Handover

    Report, proof that the measures work, and a final review. Your team can carry the result forward on its own.

Formats

  • Architecture and security review
  • Threat modeling workshop
  • Phishing simulation
  • Incident response
  • Guidance while building an AI platform

ring 1faq

Frequently asked questions

How are ringnull and 0x68.de related?

Both sites belong to me, Tim Fiedler. 0x68.de covers AI enablement, data and software engineering. ringnull is the security practice: AI security and IT security. One engagement can combine both, and either way you have a single point of contact.

Do you also review systems that are already in production?

Yes. A review of a live system starts with a clear agreement on what may be tested and what may not. Changes to production only happen after we agree on them.

Do you work remotely or on site?

Both. Remotely across the DACH region, on site within about 150 km of Oldenburg. I like to run workshops on site. Working languages are German and English.

How do you handle confidential information?

We sign a non-disclosure agreement before the first detailed conversation. I only exchange credentials and findings encrypted, for example with PGP.

ring 0contact

What needs to be reviewed?

A few sentences on the system, the occasion and the timeline are enough. I usually reply within 24 hours.

Prefer email: tim@0x68.de

Please send confidential details encrypted with my PGP key. PGP

Your details are sent to me by email and only used to handle your enquiry. More in the privacy notice.