Introducing RagnarOps Security Labs

Hello everyone! It's Pablo Ruiz Encinas, Founder/CEO/Creator/Head of RagnarOps Security Labs, and I would like to personally introduce us to all of you. So please take a seat, and thanks a lot for your interest.

I've been really looking forward to officially presenting this project to the world and, after more than two years of procrastination ideation, I do believe it is now the right time to go live.

In this first blog post, the idea is to present the idea behind this project, as well as to answer some of the key questions that you may have, such as:

• Who we are
• What we do
• Why we exist
• What you can expect from us
• How to reach out, and the roadmap moving forward

Let's jump into it!

Who we are

RagnarOps Security Labs is an offensive security brand created and ideated during 2024. Back then, the idea of creating something that belongs to me, something that I could shape as I wished, had already been on my mind for a long (long) time. I could relate everything I did during that time, but perhaps that's for another blog post. The TL;DR is that in 2024, I noticed that I was getting two main things quite recurrently:

1. Questions about offsec in general, such as career path orientation, how to do X, how to achieve Y, my opinion on Z
2. Requests from small businesses, coming from friends, family and people in my network, to help them with their cyber security needs

So eventually, I started to get some projects as a consequence of word of mouth. Projects that I used to work on during my evenings, weekends or spare time, bringing some extra income.

It was at that moment that I knew I wanted to create my own cyber security brand. Something I could use to present my work to people and (eventually) grow. And yes, I know I could have done the same by just using my name/social presence, but I somehow feel more comfortable recreating myself under a brand. It also looks more professional in my opinion, and it's easier to scale if one day there are more people to join (yes, I have some names on the table).

I can't miss the opportunity to share why this name, and where it comes from. As an enthusiast of mythology, especially Norse mythology, and after having lived in Norway for four years, I wanted a brand that could be easily identifiable through deep lore. I also like wordplay, so I thought of one that would match all of this while still being meaningful. RagnarOps comes from Ragnarök, the Norse apocalypse. The logo evokes several elements: the outer hexagon is a reference to Jörmungandr, the World Serpent, and the inner figure depicts a helmet, each half made of a minimalistic dragon's head. This is a reference to Huginn and Muninn, which represent thought and memory, aligning perfectly with what we do during an engagement: the thinking finds the way in, and the memory knows what's actually relevant for our clients.

What we break, and what you get back

Right now, we are covering six disciplines, each one ending in evidence you can act on:

• Red team operations: Objective-driven intrusion modelled on a named threat actor, full scope or from an assumed breach.
• Penetration testing: Cloud, infrastructure and applications, not a simple automated scan.
• Malware development: Bespoke implants and loaders for realistic emulation, documented, and burned when the engagement ends.
• Detection engineering: Replication of TTPs alongside your blue team, turning each finding into a tested detection.
• Cloud security: Attack paths through AWS, Azure and GCP, from identity and misconfiguration to the privilege chain that ends in your data.
• AI security: Prompt injection, agent and tool abuse, RAG exfiltration paths and the model supply chain, tested against the system you actually run.

Engagements are aligned to the industry's most relevant frameworks, methodologies and regulations: MITRE ATT&CK, PTES, OWASP, TIBER-EU, TLPT and DORA. This doesn't imply accreditation, certification or affiliation; it describes how the work is run.

Working with us does not end when you get a report. Every finding ships with a working proof-of-concept and the exact path to close it, so your team can reproduce the problem and confirm the fix efficiently. Moreover, we want to remain available to you for any further inquiry, question, doubt or potential follow-up that you might have. We want to be your actual security partner, not just a "report deliverer". We care about you: we only succeed if we leave you in a better situation than when we met. That requires real connection, companionship and a personal relationship.

In return for your trust, we bring experience from several different industries, namely railway, the public sector, finance, entertainment and critical infrastructure. Additionally, we are extensively certified by the most recognized entities. To highlight some: OSCP and OSCE³ (OSEP for evasion, OSWE for the web layer, OSED for exploit development), GPEN and GCIH, CRTO for red-team operations, and AWS/Azure for the cloud work.

Why yet another security brand?

On top of what has already been explained above, it is obvious that we are dealing with a peculiar reality. It is still not clear whether that's good or bad, but one thing is sure: these are the cards that are on the table, and we have to play with them.

Given how fast everything is changing, it has never been easier to feel lost, confused or simply overwhelmed. Today anyone can ship a SaaS over a weekend, connect an AI assistant to the company inbox, or spin up a cloud server in two clicks. Having all those tools and resources lets people do a lot more, but it doesn't mean the result meets minimum security standards. Most of the time, it doesn't even mean people know where to start with the new problems (and possibilities) that came with them. And usually, nobody checks whether that SaaS leaks its customers' data, whether that assistant can be talked into forwarding the inbox to a third party, or whether that server is open to the whole internet.

That's the gap we want to close. Our idea is to be the security companion you can reach out to for advice on how to do things properly. We don't want to just be there from the start date to the end date; we want your security posture after working with us to be reasonably better than it was before.

More specifically, we are very interested in continuing to help smaller businesses, the ones that perhaps cannot afford the typical prices of big corporations or well-known security firms. Those players matter, and they are at risk: most of them don't have the capacity, the knowledge or the resources to take care of their security, yet they make up a considerable part of today's business landscape, and that part keeps growing. They are also where this whole project started (remember those requests from friends and family?).

And then there's the obvious one: a simple security scanner just lists the weaknesses you have. It cannot tell you which three of them chain into the system you would least like to lose, or whether your systems and procedures would notice somebody walking that chain. In the same way, AI agents can overwhelm inexperienced operators with huge, convincing outputs and hallucinations in the best case, not to mention that they can easily get out of control, causing severe disruption to your business or a considerable hole in your credit card. All this requires someone to walk it. That's why our motto is "We model the adversary your tooling is built to miss". We walk the path that adversary would take, and hand it to your engineers in a form they can replay, fix and close.

Finally, and from a personal perspective, this is also a learning experience: committing to an idea, shaping it, growing it... There's a component of getting exposed to a bunch of things that fall well outside the comfort zone. Things like social media management, brand strategy, marketing, financial and legal obligations, community management, SEO, product development... In the end, our first goal as of today is to be a better us, learning by doing and, along the way, trying to help others as much as possible. So why not?

What you can expect

I want to split this into two areas: what you can expect from a content creation perspective, and what you can expect from a professional perspective.

From content creation:

• Honest, non-AI-slop content: human-written blog posts and personal videos.
• Direct and straight-to-the-point content: I hate endless posts. I'd much rather split a topic into two or three different entries, each one covering a small piece of the cake, than present the whole cake at once (and I hope I'm not the only one).
• In the Labs, expect field notes on tradecraft, adversary simulation, detection engineering and the research behind them. I also want to post teardowns on the YouTube channel covering news, opinions and whatever I feel motivated to do. I'm keeping an open door to live sessions for research, tooling and office hours with the community as well, although this is not going to happen in the very near future.

Professionally speaking, this is how we operate for every engagement:

• Mutual NDA first: Signed before any technical discussion. Scope, targets, test windows and everything out of scope are agreed in writing before a packet moves.
• A reply within 48 hours: A threat model, a proposed scope and a price, or a straight answer that this is the wrong practice for the job.
• Close contact with the operator: No subcontracting, and that will not change without telling you first.
• Your evidence stays contained: Held locally on encrypted storage, copied to the cloud only if you agree in writing, and destroyed 90 days after delivery. Findings and reports are sent via encrypted email and, soon, through our private, invitation-only client Portal.
• A plan for the bad week: This has never happened, but if we become unavailable mid-engagement for major reasons and the work cannot resume, you keep the evidence collected so far and pay only for the work delivered.
• Honesty and full transparency: If your request needs several testers working simultaneously to meet a certain deadline and we cannot commit to delivering, we will say so on the scoping call.

These are some scenarios, taken from past requests we have received, where it makes sense for you to reach out:

• You have bought X detection technology and want to know whether it catches an operator who is trying not to be caught.
• A cloud estate, an application or an AI system with tool access is about to go live, and you want to make sure it is secure.
• A regulator, an auditor or your board wants to know what an intrusion would cost.
• A previous pentest came back with a clean report, and nobody quite believes it.

It is crucial to highlight that, for now, this is a project that is run during spare time, weekends and evenings. This is why engagements run one at a time, so ask for a start date in your first message: it is usually the constraint that decides everything else. NO work will be accepted if there's no availability in our agenda to deliver according to the high-quality standards that we are committed to. Everything will be discussed and carefully analyzed together with our clients to find the best accommodation if possible, and if not, we prioritize transparency and honesty over conflicting promises and mediocre results.

How to reach out, and future roadmap

Thanks for following along this far! You can get in touch anytime to discuss any cyber security related topic, rant, suggest stuff, or when you need something to be proven rather than assumed.

As of today (October 2026), this is what our roadmap looks like:

• We are working on finishing the official Portal application, our platform for automated customer onboarding, reporting and project lifecycle management.
• The Spanish version of the website is WIP; a properly localized copy will be released as soon as possible. After that, the Portal will go next.
• We want to consolidate our brand across all social media.
• A custom AI harness is being developed to streamline the routine tasks that we want to offload, so we can focus on what is really important: quality content and exceptional service.
• We are planning to integrate several features so potential clients can quickly get an idea of what they might need the most and where their assumptions might fail, and so we can educate them on how to approach their security.

If you have any specific need, feel free to describe the objective rather than the tool you think you need, and we will assess which service best fits what you really need. Use the engagement form or write to contact@ragnaropsec.com. We will be happy to get to know you better.

You can also follow us on LinkedIn, Instagram and YouTube.

Hope you'll join us on this new adventure!