tbcsec.io
red team operator — defense industry

TOM COLLIER

I emulate advanced adversaries against enterprise-scale environments — planning, executing and reporting the campaigns that expose critical gaps before someone else does.

View work Read the dossier
20+red team engagements led
1,900+students served by CTF infra
1,200+EC2 instances orchestrated
−80%registry recon time, via tooling
selected work

FLAGPOST

flagpost.io ↗

The modern, open-source CTF platform. Self-hosted and batteries-included: real-time WebSocket scoreboards, a no-code automation engine, CRDT-backed collaborative notes, and a built-in support desk. Built after running a 1,900-student competition on tooling held together with plugins and spreadsheets.

Python PostgreSQL AGPL-3.0 creator & maintainer
in development

FalsePrompt

An adversarial testing harness for LLM features in hostile, multi-user apps. Pass means the model never had the gated data — so even a fully jailbroken assistant has nothing to leak.

LLM securityAI red teaming
 open source

CTFd Support Ticket Plugin

A support-desk plugin for CTFd — tickets, screenshots and admin guidance inside the platform. Built to survive a 1,900-player event.

PythonCTFd
 this site

tbcsec.io

A static site with a hand-rolled WebGL datamosh engine and a decoy homepage that gets taken over. No trackers, no cookies.

AstroThree.js
writeups
  1. 2026-08-07 Threat Modelling a Room Full of Attackers: Securing a CTF Platform A red teamer's first attempt at building a formal threat model, applied to Flagpost — an open-source CTF platform whose entire userbase is skilled, motivated attackers — reframing the platform as the vault holding every flag and walking through how STRIDE, kill chains, and MITRE ATT&CK surfaced the threats that matter and the ones worth living with.

all writeups →

contact

The inbox is open — engagement inquiries, collaboration, or questions about Flagpost.

tom@tbcsec.io