Founded on Vancouver Island, British Columbia, Riptide Cybersecurity operates on a strict, practitioner-first philosophy: High-stakes security validation requires specialized tradecraft, not corporate bureaucracy or automated scanner dumps.
Riptide is led by Principal Operator Jordan Gibson, a senior offensive security specialist holding industry-premier technical certifications (OSEP, CRTO, CARTP, OSCP, BSCP). We focus on providing a trusted safe harbour for organizations—delivering the technical clarity, rigorous validation, and direct partnership needed to ensure long-term security and compliance success.
Rather than passing clients through layers of account managers or junior analysts, Riptide provides direct, senior-level technical engagement. Organizations partner with us when they face high-stakes compliance deadlines (SOC 2 Type II, PCI DSS 4.0.1, HIPAA) or stringent cyber insurance underwriting mandates.
When you engage Riptide, you work directly with Jordan from initial scoping and threat modeling to hands-on adversarial emulation, collaborative remediation, and executive debriefs.
Industry Vetted Certifications & Technical Tradecraft
Every assessment at Riptide is executed by practitioners holding industry-elite, 100% practical certifications. Unlike theoretical multiple-choice exams, these credentials are earned exclusively through grueling 24-to-48-hour hands-on live-fire examinations that validate real-world offensive tradecraft:
Demonstrates advanced adversary tradecraft through a rigorous 48-hour hands-on examination. Validates custom payload generation in C#/C++, process injection techniques, memory obfuscation, and bypassing enterprise Endpoint Detection & Response (EDR/Antivirus) architectures.
Demonstrates the industry benchmark in hands-on offensive methodology under strict 24-hour live-fire examination. Validates practical exploitation, privilege escalation, hybrid network auditing, and professional technical risk reporting.
Demonstrates practical offensive auditing and defensive engineering of enterprise wireless perimeters. Validates rogue access point detection, packet analysis, RADIUS authentication security, and 802.1X / WPA3-Enterprise configurations.
Validates real-world offensive adversary tradecraft against Microsoft Azure and Microsoft Entra ID (Azure AD) cloud infrastructure under a strict 24-hour practical examination. Proves technical mastery in tenant reconnaissance, privilege escalation, abusing Azure Application Registrations and Service Principals, extracting Managed Identity tokens, compromising Key Vault secrets, cross-tenant pivots, and hybrid identity attack chains bridging on-premises Active Directory to the cloud.
Demonstrates deep technical mastery of Active Directory domain dominance and post-exploitation tradecraft aligned with MITRE ATT&CK®. Validates Kerberos ticket abuse (Golden/Silver tickets, AS-REP roasting), lateral movement, and Cobalt Strike Command & Control (C2) operational security.
Demonstrates code-level manual exploitation of modern web applications and complex API ecosystems. Validates PortSwigger's rigorous standard for discovering authorization logic flaws, JWT vulnerabilities, server-side request forgery (SSRF), and advanced injection vectors that automated scanners miss.
Demonstrates foundational excellence across enterprise defense-in-depth principles, cryptographic baselines, identity and access management (IAM), vulnerability assessment, and risk management frameworks.
Demonstrates comprehensive technical fluency in enterprise network infrastructure, routing and switching topologies, the TCP/IP protocol suite, DNS/DHCP architectures, and network segmentation strategies.
A Direct, Partnership-First Approach
In this industry, it is common for a senior consultant to sell an engagement, only to pass the actual work down to a junior analyst running automated tools. Riptide is built on doing the exact opposite.
We operate on a model of strict accountability and direct partnership:
When you hire Riptide, Jordan performs the assessment. No handoffs, no middle-management.
Scanners create noise; operators find truth. Every vulnerability is manually verified so your IT team isn't chasing false alarms.
We don't just break things and leave. We help your team build practical, lasting solutions.
Deliverables are built to answer the exact questions your auditors and underwriters are asking.
01. Direct Communication from Start to Finish
There is no game of telephone. You communicate directly with the person testing your network. This means faster answers, clearer context, and zero bureaucratic delays when your team has complex architectural questions.
02. Rolling Up Our Sleeves to Fix It
Finding the hole is only half the job. Coming from a system administration background, we treat security as an active partnership. We sit down with your engineers to brainstorm fixes, evaluate trade-offs, and verify that the solution actually works without taking down your network.
03. Standing By the Work (Validation & Attestation)
We want you to pass your audit. Every engagement includes a complimentary 90-day verification retest for high and critical findings. Once the holes are patched, we issue the formal Attestation Letter you need to hand to your board, buyers, or insurers.
Regulatory Frameworks & Standards Alignment
Our technical execution is strictly aligned with globally recognized cybersecurity baselines:
- PCI DSS 4.0.1 (Requirement 11.3 & Requirement 11.4 Mandates)
- SOC 2 Type II (Trust Services Criteria CC7.1 & CC7.2)
- Cyber Insurance Underwriting Baselines (MFA, Active Directory Tiering, EDR, Immutable Backups)
- HIPAA Security Rule (§ 164.308 Technical Safeguard Evaluations)
- OWASP Application Security Verification Standard (ASVS v4.0.3)
- OWASP Web Security Testing Guide (WSTG v4.2)
- MITRE ATT&CK® Enterprise Framework
- Penetration Testing Execution Standard (PTES)
- NIST Cybersecurity Framework (CSF 2.0)
Partner With Riptide
Whether preparing for an upcoming SOC 2 or PCI DSS audit, answering enterprise vendor risk questionnaires, or ensuring your infrastructure passes stringent cyber insurance underwriting reviews, Riptide Cybersecurity provides the certified technical execution you need.
