About Halcyon · East 86th St, New York, NY

Mostly, We Try Door Handles.

A lock-pick set and a brass key laid in a neat row on lilac felt beside a folded scope letter
Fig. 02 — The kit. Honestly, mostly the laptop.

Halcyon is a small security consultancy on the Upper East Side. Companies pay us to rattle every handle they own — the login page, the API, the vendor VPN, the side door with the badge reader — and then tell them, plainly, which ones turned. Pen tests, audits, incident-response plans. That’s the whole menu.

Book a free scoping call See the three services

Origin story, short version

Small Shop. Loud Findings.

The companies that most need a proper break-in test usually get the thinnest one. We started Halcyon to fix that.

Here’s the pattern we kept seeing. A 40-person fintech, an architecture studio sitting on client blueprints, a clinic with a patient portal — each one gets a customer security questionnaire, panics, and buys whatever “pen test” shows up first. Sometimes that’s a junior with a scanner and a 90-page PDF. Sometimes it’s a questionnaire about the questionnaire.

So we kept the firm deliberately small. The tester who writes your rules of engagement is on the keyboard during the break-in and on the call when the findings land. No relay race, no account manager translating “SQL injection” into “a small concern.”

We work from an office on East 86th, a short walk from the Q, Monday to Friday 9:30 to 4:30 — later when a scope letter says the testing window runs overnight. Most of the actual work happens over VPN and video, so your office doesn’t need to be anywhere near ours.

And the name? The Greeks had a myth about the kingfisher — the halcyon — getting a stretch of flat, windless sea every winter to nest. We take on the noisy part: the poking, the phishing emails your team will roll their eyes at, the “we found something” call. The rest of your calendar gets to be calm. Calm is the deliverable.

A kingfisher perched on a reed above glassy, lilac-tinted water at dawn
The halcyon: one kingfisher, one flat sea, one quiet winter.

House rules

Our Own Rules Of Engagement

Every client signs a scope letter before we touch a thing. This is the one we hold ourselves to — same clauses, every engagement, whether the quote is $3,600 or five figures.

  1. RoE · 01

    Signature before a single packet.

    Nothing gets scanned, phished, or tailgated until the scope letter is countersigned. Not even a ping. If the paperwork runs late, the test starts late — and we’re fine with that.

  2. RoE · 02

    Manual first, tools second.

    Scanners help us look around. Anything that makes the report was reproduced by a human, with a screen recording you can replay for your engineers.

  3. RoE · 03

    Criticals get a phone call.

    Confirm a critical finding and your named contact hears it from a person within 4 hours. Not an email, not a ticket, not page 31 of a PDF.

  4. RoE · 04

    Fixes in your stack’s dialect.

    Remediation is written for what you actually run — a Django middleware tweak, an Okta sign-on policy, a Terraform diff — instead of a link to a generic advisory.

  5. RoE · 05

    The retest is part of the price.

    Patch what you can and we re-run every fixed finding within 60 days at no added cost, then reissue the report so the version customers see shows the doors shut.

  6. RoE · 06

    We’ll suggest the smaller invoice.

    If a $4,850 audit answers your question better than a $9,750 web-app test, that’s what we’ll tell you on the scoping call. Out loud. On purpose.

  7. RoE · 07

    Your data leaves when we do.

    Screenshots, captured credentials and test artefacts are wiped once the retest closes, and we confirm it to you in writing.

— Halcyon, New York, NY

Want the same clauses in your scope letter? Ask on the call; they’re already in the template.

Hard passes

Things We’ve Crossed Off

Security has plenty of ways to make money that don’t make anyone safer. Here’s what we decided not to sell — and what you get from us instead.

  • We don’t sell: Rebadged scanner reports

    InsteadManual testing, every finding reproduced on video before it goes in the report.

  • We don’t do: Surprise denial-of-service

    InsteadDoS stays out of scope unless you ask for it in writing, with a time window you pick.

  • We don’t do: Fear-based upsells

    InsteadThe smallest scope that answers the question you actually came in with.

  • We don’t do: Testing on a handshake

    InsteadA two-page letter, signed at both ends, with a named person on each side who can call a hard stop.

  • We don’t do: Retests billed as round two

    InsteadA 60-day retest folded into every pen test quote from day one.

A Tuesday, roughly

Inside One Testing Window

Day three of a typical external network test, seen from our side of the VPN. Every day of a test ends the same way: with a note in your inbox, not radio silence.

  1. 9:30

    Standup With Your Contact

    Ten minutes. What we touched yesterday, what’s on deck today, and anything on your side that looked off overnight.

  2. 10:15

    Recon Refresh

    New subdomains, changed DNS, that staging box somebody spun up at 11 p.m. and forgot to mention. The map gets redrawn daily.

  3. 12:40

    Chaining

    Three “mediums” go in, one “wait, how did that work?” comes out. Manual exploitation, notes and screen recording running the whole time.

  4. 3:10

    The “Found Something” Check

    Anything that smells critical gets confirmed twice. If it holds up, your phone rings — you hear it from us today, not in next week’s report.

  5. 4:30

    Daily Note

    A short written recap: in progress, cleared, needs a decision. Nothing alarming buried in paragraph six.

Running a test after hours or across a change freeze? Overnight windows are booked through the scope letter, and evenings are open by appointment — the daily note still lands.