Security programs and the software that runs them.
- We build cybersecurity programs as your fractional CISO, and for the Coast Guard's maritime cyber rule.
- We partner with companies to build the custom software their work needs.
- We build it all with AI under one method, and every change is read by an engineer and gated by a pipeline.
- 1ScopeWhat you run and who you answer to.
- 2AssessThe gaps, ranked by what could hurt.
- 3BuildPolicies, plans, software.
- 4RunExercised, audited, kept current.
ONE RECORD FROM SCOPE TO RUN
FOXX CYBER LLCCOLORADO SPRINGS, CO
Drawn byJ. P. Price, CISSP, CISM
OwnershipVeteran-owned
REV OCT 2026
Contact sales
Programs we build with you
A named security leader, a plan with owners and dates, and the records that prove it.
| Sheet | Title | Scope | Status |
|---|---|---|---|
| FC-101 | Fractional CISO | A security leader for organizations that cannot justify a full-time one. | |
| FC-102 | Maritime cybersecurity | Cybersecurity programs for the Coast Guard's Marine Transportation System cyber rule. | |
| FC-103 | Custom solutions | We partner with companies to build the software their work needs. |
Built with AI. Read by an engineer. Gated by a pipeline.
Every product we ship, and the software we build for partners, is made under Vibe Sec Ops, a method we publish so you can check it.
Before the merge
RulebookThe repository's rules, read by the agent first.
Agent draftsAn AI coding agent writes the change.
Engineer readsEvery diff, before it merges. Pushback becomes a rule.
Pipeline, on every merge request
- Build
- Unit tests
- Invariant gate
- SAST
- Dependency and secret scan
- Image scan
- SBOM
Red: fix it, or write it downAn accepted risk with a review-by date, or a POA&M with milestones. Silencing a warning fails the build.
After green
ReleaseThe exact image the scanners passed, retagged by digest.
Evidence keptScanner reports, SBOMs and triage, mapped to the controls they satisfy.
Software we build and run
Security software for programs and compliance, and business software for the work around them.
Security software
| Sheet | Title | Scope | Status |
|---|---|---|---|
| FC-201 | vCISO | A personal AI security advisor for small businesses. | |
| FC-202 | Bedrock GRC | The governance, risk and compliance console behind our fractional-CISO practice. | |
| FC-203 | Bedrock CMMC | CMMC compliance software for defense contractors and the firms that serve them. | |
| FC-204 | Bedrock Flowdown | CMMC flow-down tracking for prime contractors. | |
| FC-205 | Bedrock C3PAO | The containerized assessment client for CMMC assessors. | |
| FC-206 | Bedrock RMF | An open-source alternative to eMASS and Xacta for NIST SP 800-53 packages. | Open source |
| FC-207 | Bedrock AFT | Assured File Transfer: cross-domain transfer requests without the paper form. | Open source |
Business software
| Sheet | Title | Scope | Status |
|---|---|---|---|
| FC-301 | Foxx HQ | The back office for small businesses and nonprofits. | |
| FC-302 | DevOS | The owner's draw and lien-waiver system for real estate developers. | Pilot |
| FC-303 | VarsityLedger | A school's athletics program in one place. | Pilot |
| FC-304 | RailCompliant | FRA compliance for heritage railroads. |
Drawn by a practitioner
Foxx Cyber is Jeremiah P. Price's company: a veteran-owned firm in Colorado Springs that builds security programs and the software behind them. The same person who scopes your program reads the code it runs on.
- Credentials
- CISSP, CISM
- Service
- Air National Guard, DoD
- Ownership
- Veteran-owned
- Based in
- Colorado Springs, CO
- Method
- Public, Apache-2.0
Notes for defense contractors
Plain-language guides to CMMC, and a free reading aid for every NIST SP 800-171 requirement at cmmc.foxxcyber.com.
- What is CMMC? A complete guide for defense contractorsCMMC (Cybersecurity Maturity Model Certification) is the DoD's framework requiring defense contractors to prove their cybersecurity posture. Learn what CMMC is, who needs it, the 3 levels, and how to get certified.
- CMMC Phase 2 is suspended. Your security obligations are not.On July 13, 2026 the Department of War suspended CMMC Phase 2 third-party assessment requirements. What was suspended, what still applies — DFARS 7012, NIST 800-171, SPRS affirmations — and what defense contractors should do now.
- The CMMC assessment process: from self-assessment to certificationA practical guide to the CMMC assessment process — from self-assessment and evidence collection to SPRS scoring and preparing for your C3PAO evaluation. Learn what assessors look for at each stage.
Tell us what you need built.
A person reads every message and answers, usually within one business day. No pricing page and no sales script: a conversation about your work.
FOXX CYBER LLCCOLORADO SPRINGS, CO
Drawn byJ. P. Price, CISSP, CISM
OwnershipVeteran-owned
REV OCT 2026
Contact sales