ABOUT Why the product is an operating loop

Security is a team of workflows, not a scanner.

ZeroQuarry was built where security work actually lands: in disclosure inboxes, engineering backlogs, pentest statements of work, audit evidence folders, and customer conversations. Fifteen years across companies including Elastic, Kong, and Vectara shaped a product that can investigate deeply while keeping the decisions, handoffs, fixes, retests, and proof connected.

Meet the team -> See the method

about://zeroquarry LIVE

$ whoami

ok zeroquarry · adversarial agents · est. 2026

$ pedigree

ok 15y · elastic · kong · vectara · hp · spread.ai

$ security-programs

ok soc 2 x4 · pentest sows x3 · cve triage x3

$ disclosures --as-reporter

ok h1 broken authn @ major travel · paid

$ mission

ok make rigorous product security operational for lean teams

01 · The problem

Security work fragments
before it scales.

A finding can start in a scanner, a consultant PDF, a researcher email, a pull request, or a customer questionnaire. The expensive part is turning that signal into a trusted decision, owned remediation, a verified fix, and evidence someone else can understand.

01 Static scanners

SAST-0421 potential SQLi LOW

SAST-0422 hardcoded secret LOW

SAST-0423 potential XSS MED

SAST-0424 potential SQLi LOW

+1,847 more · 99% unread

Pattern matching, not proof.

Legacy SAST and DAST tools flag anything that looks suspicious. Severity is graded by guesswork. Engineers stop reading the queue by the third sprint, then learn to filter the whole tool out.

pattern-based, not behavioural
no exploit ever attempted
alert fatigue by week three

02 Point-in-time pen tests

JANFEBMARAPRMAYJUN

JULAUGSEPOCTNOVDEC

2 windows · 10 days each · ship something else?

Excellent tests, isolated in time.

Consultant-led penetration tests remain valuable. They cover a defined scope and moment. They do not cover what shipped on Tuesday, merged last week, arrived through a researcher, or changed while the report moved through remediation.

point-in-time only
scope-limited by SOW
shipping continues without them

03 Manual security operations

finding: security-inbox/184

owner? unknown

fix verified? unknown

customer evidence: manual

context lost between systems

Context lost at every handoff.

Inbox threads, scanner consoles, tickets, pull requests, retest notes, and assurance folders each hold part of the truth. Lean teams spend their limited security time reconstructing the record.

ownership lives in another system
retest evidence is detached
buyer proof is rebuilt by hand

ZeroQuarry's bet: combine investigative agents with skeptical review, then keep the finding, human decision, remediation, retest, and external proof in one operating record.

02 · The method

A finding is useful when
the next decision is clear.

Adversarial review is one part of a broader method. Each stage should reduce ambiguity for the next person without silently taking authority away from them.

PHASE 01

Receive and scope

Work can begin from a repository, release artifact, authorized live target, pull request, scheduled review, API request, or forwarded researcher report. Authorization and boundaries remain explicit.

PHASE 02

Investigate and prove

Coordinator and specialist agents map the target, follow high-value attack paths, gather source references and runtime evidence, and push toward reproducible impact where the environment permits it.

PHASE 03

Challenge and decide

Vendor-style review pressure-tests reachability, severity, assumptions, and evidence. A human can validate, dispute, accept risk, assign ownership, or request deeper analysis with the reason preserved.

PHASE 04

Remediate and prove

Generate a patch, stage a GitHub pull request, create an engineering ticket, or coordinate an external disclosure. Retesting updates the same lineage, and controlled evidence can be shared with the people who need it.

The loop can begin on a pull request, schedule, release, inbound report, or assurance request. It ends when the team has a defensible decision. A completed scan is only one step.

03 · The team

The operators
behind the loop.

ZeroQuarry was built by people who've stood on every side of a vulnerability report: the engineer who shipped the bug, the manager triaging the disclosure, the HackerOne reporter going the other way, and the operator running the SOC 2 audit afterwards.

● Founder

Shane Connelly.

Founder · ZeroQuarry

Previously at Elastic, Kong, Vectara, HP, SPREAD.AI.

Fifteen years building developer infrastructure that handles a lot of trust: search at Elastic, the API gateway at Kong, RAG at Vectara, and developer platforms before and after. Security work shadowed every role.

Across those rooms: sat on the security mailing list deciding which inbound reports earned a CVE. Negotiated and reviewed pen-test SOWs with three external firms. Ran SOC 2 engagements end-to-end at four companies. And on the other side of the desk, a HackerOne payout for breaking authentication on a major travel platform.

The pattern across all of it: finding a plausible issue was rarely the whole job. Teams still had to validate it, choose an owner, move a fix, prove the fix worked, and explain the result externally. ZeroQuarry is built around that complete operating loop.

field note · 2026 “The security team is not one job. It is a chain of investigations, decisions, handoffs, and proof. ZeroQuarry is built to make that chain rigorous before a growing company can staff every specialty itself.”

Personal site -> shane@zeroquarry.com -> Research & disclosures ->