Law firms are putting privileged client data into AI.
Private AI where client data never leaves, shadow-AI audits, security, and managed IT, built around the confidentiality duty your firm carries. See the services and pricing made for law firms.
The proof.
Selected engagements (one published with the client's permission, the rest under NDA), plus independent recognition. Capability shown on results.
Full-scope penetration test of a live, multi-tenant AI SaaS application and its MCP server.
We attacked a live software product the way a real intruder would. We tried to reach other customers' data, break into systems that should have been off-limits, hijack logins, and slip past its defenses. By hand, every attempt proven, start to finish.
Result: no exploitable vulnerabilities identified. Two non-exploitable hardening notes reported.Real paid work against live systems, across every kind of target. Client names and data stay private under NDA. Here's the kind of work we do, in plain terms.
Binary Exploitation
Turned subtle memory bugs in compiled software into full remote control of the machine.
Web Exploitation
Chained website flaws together to reach internal systems and ultimately run our own code on the server.
Reverse Engineering
Pulled apart compiled programs to recover their hidden logic, secret keys, and checks.
Cryptography
Broke weak encryption that was protecting data it should never have been trusted to protect.
Forensics
Reconstructed what happened from network captures and hidden files, the digital evidence trail.
Hardware & ICS
Read the signals straight off physical devices and industrial control systems to find their weak points.
Coordinated Disclosure: Marketplace
Found a real security hole in a live online marketplace and reported it responsibly through its official program.
Beyond client work, offensive skill is validated publicly on Hack The Box. On HTB's MCP Try Out: a 31-of-37 solve sweep across all eleven categories for 25,100 points, rank #39 of 300. Binary exploitation, web, reverse engineering, cryptography, forensics, hardware, ICS, blockchain, coding and more. Standings verifiable on request.
What we do
Three practices, one local partner: offensive security, managed IT & cybersecurity, and AI integration, for Virginia startups and small businesses that want it handled, not juggled.
Web Application Testing
We attack your website and web apps the way a real criminal would, then hand you a plain-English list of what is exploitable and what is not and how to fix it. Every finding is proven first, so you're never chasing false alarms.
API Security Assessment
The APIs behind your apps and integrations are a favorite way in, and most go untested. We probe yours for broken access, data leaking between customers, and the holes automated scanners quietly miss.
AI / MCP Security Review
Connecting AI assistants or agents to your data and tools opens a door most companies ship without ever testing. We check whether yours can be tricked into leaking information or taking actions it never should.
Managed IT Services
Your outsourced IT department: we keep your computers, email, accounts, and network running, patched, and backed up. You get help the moment something breaks, and prevention so less does.
Managed Security & Monitoring
Priority-managed services, monitored 24/7.
Compliance Readiness & Hardening
We get you audit-ready for SOC 2, HIPAA, PCI, and more, then keep you there with the policies and evidence auditors expect. We hold ourselves to the same controls: a HIPAA Business Associate Agreement is available on request.
AI Integration
We put AI to work where it helps: assistants, search over your own documents, and automation wired into the tools you already use. Scoped to a real problem, secured, and useful, not a gimmick.
Self-Hosted AI Infrastructure
Want AI that runs on your own hardware with your data never leaving the building? We build and run private, on-premises AI, no data sent to outside clouds and no per-seat SaaS bill, the exact stack we run ourselves.
Managed AI Operations
We run your AI long-term, kept current, guarded against misuse, and cost-controlled. It stays sharp and safe without an ML team on your payroll.
Project / Fixed-Scope
A defined piece of work (a pen test, an AI integration, an IT or security buildout) with clear deliverables, a prioritized report, and a debrief.
Managed · Monthly
Ongoing managed IT, security monitoring, and AI operations for a flat monthly fee. We keep it running, patched, defended, and improving.
Retest & Advisory
Re-test after fixes, recurring assessments as you ship, and on-call expertise for the security and AI decisions in between.
Plans
Simple monthly plans for the security, IT, and AI you can't afford to ignore and don't have time to learn. Pick a level. We handle it. We keep a maximum of three managed clients at a time, so each one gets our full attention; one-off projects run alongside.
Solo owners and micro-businesses.
- AI-safety review and guardrails for the AI tools you already use
- Monthly security health check, written in plain English
- Account and email hardening: MFA, phishing protection
- Backup verification
- A direct line for questions during business hours
Small teams that run on their tech.
- Everything in Essential
- Managed IT for your team: endpoints, patching, helpdesk
- Managed AI Security: ongoing monitoring of your AI tools and connections
- Backups and endpoint protection, managed for you
- Quarterly security review call
Growing businesses with compliance on the line.
- Everything in Business
- Priority response when something breaks
- Quarterly penetration test or assessment, scoped to you
- Compliance upkeep: HIPAA, SOC 2, or IRS WISP evidence kept current
- Direct line to the operator who built your setup
Users or devices are the people and computers, phones, and servers we cover. Grow past your plan? Add more at a flat $120 per user, no re-tiering. Need a one-off instead? Penetration tests $4,000; HIPAA / SOC 2 readiness, IRS WISP builds, and AI projects are scoped and quoted at a fixed price. Introductory pricing; confirmed in writing before we start.
How an engagement runs
Disciplined, authorized, and documented end to end. No test packet leaves without written scope.
Scope
Exact targets, windows, and constraints defined in a signed SOW.
Authorize
Rules of Engagement signed before any testing begins: your legal shield and ours.
Test
Manual assessment across the agreed surface. Critical findings reported out-of-band within hours.
Verify
Every finding reproduced with a positive control. No scanner-only claims.
Report & retest
Prioritized report, debrief call, and a re-test after you fix. Attestation on request.
Products we build & run
We don't just advise. We ship and operate our own production software. Proof that the security and AI work we bring to clients is built on real engineering, not slides.
QR Dynamic
A dynamic-QR SaaS: codes stay editable after they're printed (destination, WiFi password, label, expiration, password-gate) with no reprint. Correct WPA3 WiFi encoding (most generators silently downgrade and fail to connect), real scan analytics, custom styling, bulk CSV, a public API, and its own MCP server. Four-tier Stripe billing, live.
We pentested our own app and fixed it: stored XSS in the WiFi/vCard render, a TOCTOU free-tier race (closed with a Postgres advisory lock), endpoint DoS (rate-limited at the edge), and a WPA3 encoding bug competitors ship broken.
MCP Sentinel
Security monitoring for MCP servers and agentic AI: the trust boundary most teams ship untested. Continuous checks for tool-call abuse, cross-tenant isolation, prompt and indirect injection, and unsafe LLM output handling across AI-connected apps.
Built on the same in-house AI-security tooling and self-hosted models we run in Live Operations below. Launching to early clients soon.
We know AI: down to the metal
When we say "we build our AI," we mean it literally. Most AI vendors just put their label on ChatGPT or Gemini, and your data runs through someone else's servers every time you use it. We run our own AI models on our own machines, so your information never leaves the building. That is the difference, and it is why we can lock it down properly. What moves behind this page is that system: our own AI "brain," built from scratch in house on our own hardware, with no outside cloud behind it. We understand these systems because we built them end to end, and we put that to work securing, auditing, and standing up private AI for you. Shown as shape only. Names, contents, and client data never leave our machines.
Topology only. Contents, identifiers, and client data withheld. Rebuilt from the live graph on every save.
Inside the model, live
This is what "we run our own AI" looks like, live. The AI's own internals, running in real time: the embedding space and memory weave behind our knowledge base, alongside live telemetry from the infrastructure we engineered. Token-efficiency, local compute, our knowledge graph and reasoning gate, measured on our hardware. Aggregate only, no client or content data.
Continuous telemetry from three planes (host and endpoint, network, and identity exposure) is fused by a reasoning model running on our own in-house compute. Each signal is mapped to the MITRE ATT&CK technique it represents, cross-referenced against our own live vulnerability corpus, and the remediation set is chosen by a constraint solver under a real fix-effort budget. Sensitive data is sealed with a post-quantum hybrid encryption scheme, at rest and in motion. The whole loop runs on-prem: nothing leaves our walls, no third-party SaaS ever sees the data. What you see above is that system defending this very infrastructure in real time, the same stack we stand up for clients.
Built in-house. Handled for you.
Merriweather Holdings is an AI-native technical shop. We have deep, hands-on command of AI systems and integration, built on a real computer-science and data-science foundation and wrapped in security and IT discipline. Everything we offer, we first engineered and run ourselves, in-house. The live telemetry on this site is our own stack doing real work, not a demo. That's the offer: hire that capability and our operators to build your systems, secure them, run your IT, pen-test what you ship, and handle the technical tasks you don't have time for, on the infrastructure we built. Every engagement authorized and documented, every finding proven before it's reported, explained in plain English.
- Who: Merriweather Holdings, Virginia-based, operator-led
- Model: AI-native: our own in-house stack, brought to your systems
- Alignment: OWASP Top 10 · OWASP API Security Top 10 · OWASP LLM Top 10
- Discipline: signed RoE, coordinated disclosure, positive-control verification
- Proof: delivered client engagements (references on request) + independent recognition (Hack The Box standings)
Start a conversation
Tell us what you've built and what you're worried about. You'll get a scoped, fixed-price proposal. No obligation, no jargon.