POINT BLANK DEV

Security for the age of AI

You lock your doors. Your software is
wide open.

Swarms of AI agents now try every app on the internet, day and night, for one way in. One open door, and everything you’ve built can be gone in an instant. I find the open doors and lock them, before they do.

Book a call or email ross@pointblankdev.com
$25M+
moved through systems I built and run
20+ yrs
in fintech, AI and cloud infrastructure
$5K/mo
where retainers start

Trusted by teams at

  • Google
  • AWS
  • Discover
  • Comcast
  • Unisys
  • Loop
  • Stacks
  • Abra
  • MBX Systems
  • Gather
  • Apex Growth
  • Blockbeat
  • Innovative Solutions & Support
  • Merkatta
  • Tango
  • Charisma

Why now

The attackers are machines now.

AI is now finding serious software flaws faster than ever recorded. Swarms of AI agents never sleep, cost almost nothing to run, and test big companies and small ones alike, looking for one way in.

Software flaws published each month, by severityJanuary 2024 to October 2026. October’s outline is its full-month pace.
  • Critical
  • High
  • Medium
  • Low
  • Not yet rated
Software flaws published each month by severity, January 2024 to October 2026
MonthCriticalHighMediumLowNot yet ratedTotal
Jan 20242929151,22714262,582
Feb 20243338871,2661261672,779
Mar 20242911,1201,6201361213,288
Apr 20242821,2521,6831781993,594
May 20244011,8911,9422005574,991
Jun 20242979251,608941513,075
Jul 20242721,1291,335922763,104
Aug 20243079941,333592022,895
Sep 20242768871,111711672,512
Oct 20243601,2751,5521012603,548
Nov 20243521,4032,016161263,958
Dec 20242961,1291,79391833,392
Jan 20253771,4272,268109684,249
Feb 20252641,2071,7541363103,671
Mar 20253971,4111,974149623,993
Apr 20253181,4522,016149934,028
May 20253481,1172,0311353463,977
Jun 20252821,0771,9041262833,672
Jul 20253631,3041,7151052383,725
Aug 20253651,1341,785117973,498
Sep 20252941,2762,3301492634,312
Oct 20253041,4141,9631454094,235
Nov 20252549911,579126603,010
Dec 20254181,8102,3251537265,432
Jan 20264201,6151,9271461674,275
Feb 20264151,4902,0772561794,417
Mar 20266202,3062,6032551395,923
Apr 20265572,0042,6352432115,650
May 20266732,5742,6062906816,824
Jun 20269293,1973,1093072737,815
Jul 20261,3134,1083,5583853929,756
Aug 20261,8135,2354,11040669112,255
Sep 20261,5576,1915,2535631,36614,930
Oct 20261,1945,2495,24447984013,006 (through the 22nd; on pace for ~18,300)
Epoch AI, from CVE records ↗

2026, so far

  1. Anthropic holds back its newest AI

    It found thousands of serious hidden flaws in major software, some decades old. Too risky to release.

    The Hacker News ↗
  2. 155 days later

    An AI swarm hits 395 organizations

    One attacker, hundreds of AI agents, 48 countries. A school fell in 7 minutes.

    VentureBeat ↗
  3. 23 days later

    AI agents take on 1,200+ websites

    They broke into more than 100 companies, at about $50 a break-in.

    The Hacker News ↗
  4. 19 days later

    “Black October”: patch PHP or go offline

    AI finds two takeover flaws in PHP, which runs ~70% of websites. The NSA tells anyone who can’t patch to go dark.

    Axios ↗
  5. 1 day later

    “It was always going to be this way. We tried to warn the world.”

    Anthropic’s deputy security chief, Jason Clinton: it will get a lot worse before it gets better.

    OfficeChai ↗
  6. 1 day later

    3% of all critical flaws ever found turned up in the last month

    So says Chris Krebs, former director of CISA, the US cyber defense agency.

    CNBC ↗

Patching on schedule used to be enough. Now an AI-found flaw can be under attack within 4 days, and the typical company takes 43 to fix one. Google ↗ Verizon ↗

Services

Find it. Fix it. Keep watching.

  • Security review

    I look at your app the way attackers do.

  • Fixes, shipped

    Not just a report. I fix it myself, on any stack.

  • AI security

    Chatbots and agents are new ways in. I lock them down.

  • Ongoing watch

    New flaws land daily. I catch the ones that touch you.

Gut check

How exposed are you?

Most break-ins aren’t clever. They walk in through old software that nobody has looked at in a while. Find yourself below.

  • Critical

    Bots are already knocking it over

    Sounds like you if

    • Your site keeps going down.
    • Traffic spiked, sales didn’t.
    • Your host flagged odd traffic.

    AI bots are already scanning you. If the scanning alone knocks you offline, a break-in is close behind.

  • High risk

    Nobody has touched it in years

    Sounds like you if

    • The person who built it left.
    • It works, so it’s left alone.
    • Nobody knows the logins.

    It’s almost certainly missing years of security fixes. To an AI attacker, that’s an open door.

  • Unknown risk

    Someone looks after it, but has anyone checked?

    Sounds like you if

    • A developer works on it.
    • Security isn’t their job.
    • No security report, ever.

    Better than most, but busy builders miss gaps. You can’t know what’s open until someone looks.

Not sure which one you are?

That’s usually the answer. Let’s find out, free.

Book a free risk check

Selected work

Shipped, and still running.

A few public products I’ve built. Most client work stays private, as it should.

How I work

No black box. You see it every week.

  1. 01

    Map

    A kickoff call. I learn what you’ve built, what matters most and where it faces the internet.

  2. 02

    Attack

    I test it the way automated attackers will, then rank what I find by real risk, in plain words.

  3. 03

    Fix

    I ship the fixes myself, in your code, with tests, so nothing else breaks.

  4. 04

    Watch

    Short updates in your Slack, a weekly walkthrough, and a close eye on every new flaw that touches your stack.

# project-updatesExample thread

  • Ross Ragsdale

    Morning! Overnight I found an admin page on staging open to the whole internet. Closed it, and added a test so it stays closed.

  • Ross Ragsdale

    Heads up: a new flaw was published this morning in a package you use. Already patched and deployed. Nothing for you to do.

  • You

    That fast? Can we walk through it in Friday’s demo?

  • Ross Ragsdale

    Already on the list for Friday.

Ross Ragsdale holding Pogi, his corgi, at sunset

About

One engineer. Every layer.

Ross Ragsdale · Founder

For more than 20 years, Ross has built the systems attackers want most: financial systems at Discover, cloud infrastructure, and Charisma, a DeFi platform that has moved more than $25M.

He has done every job on a software team, from the servers to the screen. So he sees the gaps others miss, and closes them himself. Every engagement is his, start to finish.

The attackers are machines now. They never sleep and never stop looking. Ross stands between them and what you’ve built.

Ross, at a glance

6+ years
running Point Blank Dev, since 2020
Tech Leader
for startups in fintech, AI, esports, health and commerce
$25M+
in transaction volume through Charisma, which he built and runs
Every layer
DevOps, backend, frontend, testing, AI and security

Book a call

Don’t wait for the ransom note.

Retainers from $5K a month. A senior security engineer on your side, without a full-time hire.

Book a call
ross@pointblankdev.com