Fixed point, moving target.
We test what
you're defending —
before someone else does.
CastorWorks is a Maryland-based security firm built to serve state and federal agencies, school districts and universities, and the nonprofits working alongside them — offensive testing, AI security, and the monitoring and response coverage that watches what we found after the report is delivered.
The only Maryland-certified small business pairing penetration testing, AI red-teaming, and a real MDR/incident-response backstop.
Government moves on its own clock. We didn't want to wait on it alone.
State and federal contracting is the long game. Schools, higher ed, and nonprofits run on faster, more relationship-driven procurement — so CastorWorks pursues both from day one, not one after the other.
State & Federal Government
Agencies and the primes that support them. Set-aside eligibility via Maryland SBR, WOSB/EDWOSB, and (pending) 8(a) — see Sheet 04.
K-12 & Higher Education
Districts and universities are a top ransomware target and, as of the FCC's $200M E-Rate Cybersecurity Pilot, a newly funded one — Monitoring, Detection & Response is one of the pilot's four eligible categories, bid directly through each district's own solicitation.
Nonprofits & Mission-Driven Orgs
Grant funders increasingly flow down security requirements, and donor payment processing creates real PCI exposure — most nonprofits have no in-house expertise to meet either. Nonprofit rate card available.
Commercial Bridge Clients
Small-to-mid-size firms — especially AI startups needing model security review — provide near-term revenue and referenceable case studies while certifications and public-sector past performance are being built.
Six disciplines. One standard of proof.
Two are billed by the month — MDR and vCISO/IR retainers exist specifically so this business isn't only as strong as its next signed pentest. The rest, Pollux and the AI Vendor Security Review included, are billed by the engagement.
Offensive Security & Assessments
Network and web application penetration testing, vulnerability assessment, phishing simulation, and RMF / Authorization-to-Operate support — findings that are reproducible, prioritized, and written for the person who has to fix them.
AI Security Consulting
Adversarial testing of client AI/ML systems, LLM red-teaming (prompt injection, data leakage, jailbreak resistance), and AI governance advisory aligned to the NIST AI Risk Management Framework.
Monitoring, Detection & Response
Business-hours detection and triage today, built on a partner MDR/XDR platform rather than a from-scratch SOC, with after-hours critical-alert coverage and a clear roadmap to 24/7 as the team grows. Eligible under the FCC's E-Rate Cybersecurity Pilot for K-12 clients.
vCISO & Incident Response Retainer
Fractional security leadership — policy, risk register, board reporting, vendor oversight — paired with guaranteed incident-response availability. Built for districts, nonprofits, and small agencies that need security leadership but not a full-time hire.
Pollux — Agent Blast-Radius Assessment
Know what your agents can reach. A fixed-scope assessment, not a monitoring platform, that maps every tool, credential, and system your AI agents can touch — directly or through chained delegation — and what happens if one is compromised. Scoped and priced for the districts, agencies, and nonprofits the funded enterprise AI-security platforms aren't building for.
AI Vendor Security Review
Before you sign, or shortly after: a fixed-fee review of a specific AI vendor or tool — data-handling and training practices, contract red flags, subprocessor chain, compliance posture, and basic vendor stability — delivered as a plain-language go/no-go report with contract-language changes to request. Free companion checklist available on request.
Something else?
Security awareness training, CMMC/FERPA readiness advisory, and custom scopes are all on the table — tell us what you're solving for.
“CastorWorks defends the systems government and industry depend on — and the AI systems they're building next — through rigorous, honest security testing and practical, actionable guidance.”
Mission Statement- Rigor over theater
- Findings are proven and reproducible, prioritized by real-world impact — not scan-tool noise padding a page count.
- Plain-spoken reporting
- A program manager and a system administrator should both read a CastorWorks report and know exactly what to do next.
- Integrity of access
- Client systems, data, and models are handled under the same discipline we'd demand of a vendor touching our own.
- Compliance as a floor
- NIST 800-53, RMF, and CMMC alignment are table stakes — the goal is a client that's actually harder to breach.
Building the paperwork as seriously as the tradecraft.
Government buyers verify eligibility before they verify capability. Here's where CastorWorks stands.
Bring us the scope.
We'll bring the findings.
Reach out for a capability statement, a rate card, or to start a teaming conversation as a subcontractor or prime.